I have some variant of cool web search that CWShredder
can't remove It has taken over my hosts files, my url and my sanity this is my
log of what running right now
Everytime i try to change something back it
reverts to cool web crap including my host files urls so far it seems to only
have infected IE Firefox, netscape, opera, and mozilla are all responding great
but I need my host files in order to see the sites on my server this is insane,
if anyone want to join me in hunting these people down and killing them. I could
use the alibi's
Logfile of HijackThis v1.97.7
Scan saved at
8:42:38 PM, on 6/1/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE:
Internet Explorer v6.00 SP1 (6.00.2600.0000)
Running
processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program
Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common
Files\Symantec
Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program
Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton
SystemWorks\Norton
Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~4\NPROTECT.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Slave.exe
C:\PROGRA~1\NORTON~1\NORTON~4\SPEEDD~1\NOPDB.EXE
C:\Program
Files\Common Files\Symantec
Shared\ccApp.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Palm\HOTSYNC.EXE
C:\Program
Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\Common
Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Norton
SystemWorks\Norton
Antivirus\SAVScan.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program
Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook
Express\msimn.exe
C:\Program Files\Norton SystemWorks\Norton
Antivirus\OPScan.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents
and Settings\Interns\Desktop\HijackThis.exe
R1 -
HKCU\Software\Microsoft\Internet Explorer,SearchURL = NOT USED (OK)
R1 -
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = NOT USED (OK)
R1
- HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = NOT USED
(OK)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cashsearch.biz/redir.php
R1 -
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://cashsearch.biz/redir.php
R1 -
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = NOT USED
(OK)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
NOT USED (OK)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page
= http://cashsearch.biz/redir.php
R1 -
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://cashsearch.biz/redir.php
R1 -
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.devshed.com
R0 -
HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = NOT USED
(OK)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title =
Jeremiah's
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyServer = 127.0.0.1:8080
R1 -
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
local
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://cashsearch.biz/redir.php
R0 -
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://cashsearch.biz/redir.php
N3 - Netscape 7:
user_pref("browser.startup.homepage",
"http://home.netscape.com/bookmark/7_0/home.html"); (C:\Documents and
Settings\Interns\Application
Data\Mozilla\Profiles\default\5jatjxzh.slt\prefs.js)
N3 - Netscape 7:
user_pref("browser.search.defaultengine",
"engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src");
(C:\Documents and Settings\Interns\Application
Data\Mozilla\Profiles\default\5jatjxzh.slt\prefs.js)
O2 - BHO: (no name) -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat
6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) -
{4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} -
C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O2 - BHO: (no name) -
{5CA3D70E-1895-11CF-8E15-001234567890} -
C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) -
{748957FB-8B8E-4C90-8E84-5638AE4455A6} - (no file)
O2 - BHO: (no name) -
{AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat
6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper -
{BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton
SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Radio -
{8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 -
Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program
Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) -
{E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: REALBAR -
{4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} -
C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O3 - Toolbar: Norton AntiVirus
- {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton
SystemWorks\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp]
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run:
[AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run:
[zSPGuard] c:\program files\pjw\spguard\spguard.exe /s /r
O4 - HKLM\..\Run:
[SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 -
HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup:
HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microtek
Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard
5\ScannerFinder.exe
O8 - Extra context menu item: E&xport to Microsoft
Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button:
Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12
- Plugin for .bcf: C:\Program Files\Internet
Explorer\Plugins\NPBelv32.dll
O16 - DPF:
{166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa...director/sw.cab
O16
- DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha...v45/yacscom.cab
O16
- DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - http://mirror.worldwinner.com/games/v44/pool/pool.cab
O16 -
DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF:
{C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information
Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16
- DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://download.macromedia.com/pub/shockwa...ash/swflash.cab
O16
- DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16
- DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
StartupList
report, 6/1/2004, 8:44:15 PM
StartupList version: 1.52
Started from :
C:\Documents and Settings\Interns\Desktop\StartupList.EXE
Detected: Windows
XP (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1
(6.00.2600.0000)
* Using default
options
==================================================
Running
processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program
Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common
Files\Symantec
Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program
Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton
SystemWorks\Norton
Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~4\NPROTECT.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Slave.exe
C:\PROGRA~1\NORTON~1\NORTON~4\SPEEDD~1\NOPDB.EXE
C:\Program
Files\Common Files\Symantec
Shared\ccApp.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Palm\HOTSYNC.EXE
C:\Program
Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\Common
Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Norton
SystemWorks\Norton
Antivirus\SAVScan.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program
Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook
Express\msimn.exe
C:\Program Files\Norton SystemWorks\Norton
Antivirus\OPScan.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents
and Settings\Interns\Desktop\HijackThis.exe
C:\Documents and
Settings\Interns\Desktop\StartupList.exe
--------------------------------------------------
Listing
of startup folders:
Shell folders Common Startup:
[C:\Documents and
Settings\All Users\Start Menu\Programs\Startup]
HotSync Manager.lnk =
C:\Palm\HOTSYNC.EXE
Microtek Scanner Finder.lnk = C:\Program
Files\Microtek\ScanWizard
5\ScannerFinder.exe
--------------------------------------------------
Checking
Windows NT UserInit:
[HKLM\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon]
UserInit =
C:\WINDOWS\system32\userinit.exe,
--------------------------------------------------
Autorun
entries from
Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ccApp =
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
AVG7_CC =
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
zSPGuard = c:\program
files\pjw\spguard\spguard.exe /s /r
SunJavaUpdateSched = C:\Program
Files\Java\j2re1.4.2_04\bin\jusched.exe
--------------------------------------------------
Autorun
entries from
Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe
=
C:\WINDOWS\System32\ctfmon.exe
--------------------------------------------------
Shell
& screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not
found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not
found*
Shell & screensaver key from
Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=none
drivers=*Registry
value not found*
Policies Shell key:
HKCU\..\Policies:
Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not
found*
--------------------------------------------------
Enumerating
Browser Helper Objects:
(no name) - C:\Program Files\Adobe\Acrobat
6.0\Acrobat\ActiveX\AcroIEHelper.dll -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) -
C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll -
{4E7BD74F-2B8D-469E-C0FF-FD60B590A87D}
(no name) -
C:\WINDOWS\system32\dla\tfswshx.dll -
{5CA3D70E-1895-11CF-8E15-001234567890}
(no name) - (no file) -
{748957FB-8B8E-4C90-8E84-5638AE4455A6}
(no name) - C:\Program
Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll -
{AE7CD045-E861-484f-8273-0445EE161910}
NAV Helper - C:\Program Files\Norton
SystemWorks\Norton Antivirus\NavShExt.dll -
{BDF3E430-B101-42AD-A544-FADC6B084872}
--------------------------------------------------
Enumerating
Task Scheduler jobs:
Norton AntiVirus - Scan my computer.job
Norton
SystemWorks One Button Checkup.job
Symantec Drmc.job
Symantec
NetDetect.job
--------------------------------------------------
Enumerating
Download Program Files:
[Shockwave ActiveX Control]
InProcServer32 =
C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/shockwa...director/sw.cab
[Yahoo!
Audio Conferencing]
InProcServer32 =
C:\WINDOWS\DOWNLO~1\yacscom.dll
CODEBASE = http://us.chat1.yimg.com/us.yimg.com/i/cha...v45/yacscom.cab
[Pool
Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\pool.ocx
CODEBASE = http://mirror.worldwinner.com/games/v44/pool/pool.cab
[Yahoo!
Audio UI1]
InProcServer32 = C:\WINDOWS\Downloaded Program
Files\yacsui.dll
CODEBASE = http://chat.yahoo.com/cab/yacsui.cab
[Symantec RuFSI
Registry Information Class]
InProcServer32 = C:\WINDOWS\Downloaded Program
Files\rufsi.dll
CODEBASE = http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
[{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}]
[Shockwave
Flash Object]
InProcServer32 =
C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwa...ash/swflash.cab
[EPSImageControl
Class]
InProcServer32 = C:\WINDOWS\Downloaded Program
Files\EPScontrol.dll
CODEBASE = http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
[MSN
Chat Control 4.5]
InProcServer32 = C:\WINDOWS\Downloaded Program
Files\MSNChat45.ocx
CODEBASE = http://chat.msn.com/bin/msnchat45.cab
--------------------------------------------------
Enumerating
ShellServiceObjectDelayLoad items:
PostBootReminder:
C:\WINDOWS\system32\SHELL32.dll
CDBurn:
C:\WINDOWS\system32\SHELL32.dll
WebCheck:
C:\WINDOWS\System32\webcheck.dll
SysTray:
C:\WINDOWS\System32\stobject.dll
System:
C:\WINDOWS\system32\system32.dll
--------------------------------------------------
End
of report, 6,745 bytes
Report generated in 0.313 seconds
Command line
options:
/verbose - to add additional info on each section
/complete - to
include empty sections and unsuspicious data
/full - to include several
rarely-important sections
/force9x - to include Win9x-only startups even if
running on WinNT
/forcent - to include WinNT-only startups even if running on
Win9x
/forceall - to include all Win9x and WinNT startups, regardless of
platform
/history - to list version history only
