Help

Start a discussion
UNSOLVED

nucleart

updated

22 years ago

N

nucleart

2 Posts

0

2899

July 2nd, 2004 02:00

about:blank removal...HELP!

I am having the same problem as many others...apparently.  I have tried several things to correct this "highjacked browser" problem (CWshredder, Ad-Aware, Spybot S&D, Stinger, etc.).  I need help w/ a permanent fix.  I have included my hijackthis "log" and my next post will (hopefully) have the results from my Panda AV scan.  Thanks in advance for your help.

 

Logfile of HijackThis v1.97.7

Scan saved at 11:08:42 PM, on 7/1/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\gearsec.exe

C:\Program Files\Gilat\QMS\QMS.exe

C:\Program Files\Gilat\GSU\GSU.exe

C:\Program Files\Gilat\IBQoS\ibqossvc.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\GILAT\Internet Page Accelerator\RPAService.exe

C:\PROGRA~1\GILAT\INTERN~1\AS_Agent.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Program Files\Flash Networks\NettGain2000\Bst\Srvany.exe

C:\Program Files\Flash Networks\NettGain2000\Bst\WgwMngr.exe

C:\Program Files\Gilat\NetAgent.exe

C:\Program Files\Norton AntiVirus\SAVScan.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe

C:\Program Files\StarBand\Mission Control\HsuGui\HsuGuiControl.exe

C:\Program Files\StarBand\Mission Control\TaskBarClient.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

C:\Program Files\Nikon\NkView6\NkvMon.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

C:\Program Files\Palm\HOTSYNC.EXE

C:\Program Files\Dell AIO Printer A940\dlbabmon.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\PROGRA~1\StarBand\MISSIO~1\evrep.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Sonny\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Sonny\LOCALS~1\Temp\sp.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Sonny\LOCALS~1\Temp\sp.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Sonny\LOCALS~1\Temp\sp.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Sonny\LOCALS~1\Temp\sp.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Sonny\LOCALS~1\Temp\sp.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://register.starband.net

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Sonny\LOCALS~1\Temp\sp.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by StarBand

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9877

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: (no name) - {EF1F1BE5-3696-4D1B-9548-14598FDFE75B} - C:\WINDOWS\System32\hkemk.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe

O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"

O4 - HKLM\..\Run: [HsuGuiControl] C:\Program Files\StarBand\\Mission Control\HsuGui\HsuGuiControl.exe

O4 - HKLM\..\Run: [NettGain2000 Verifier] C:\Program Files\Flash Networks\NettGain2000\Bst\NettGain2000 Verifier.exe

O4 - HKLM\..\Run: [TaskBarClient] C:\Program Files\StarBand\\Mission Control\TaskBarClient.exe

O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe

O4 - HKLM\..\RunServices: [NettGain2000] C:\Program Files\Flash Networks\NettGain2000\Bst\WgwMngr.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe

O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE

O4 - Startup: PowerReg Scheduler V3.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe

O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)

O9 - Extra button: Research (HKLM)

O9 - Extra button: Messenger (HKLM)

O9 - Extra 'Tools' menuitem: Messenger (HKLM)

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37954.8606828704

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

 

 

(TIA, nucleart)

  • P

    pskelley

    933 Posts

    518

    0

    Posted July 5th, 2004 00:00

    Thanks for your patience, the enemy is legion, and we the volunteers are few. You do have a tough new CWS infection.  A fix is being worked on, but at present all we have is a manual fix.
    First though, you are running HijackThis out of a temporary .zip file.  Please follow the directions in the link below to place the HijackThis.exe in a permanent folder on your C: drive.
    http://russelltexas.com/malware/createhjtfolder.htm

    After you have done this, then go to the next link and try Fix #1, and if needed Fix #2, on the line New CWS Temp folder infection.  Make sure to follow the directions carefully.  When finished, post a fresh log in this same thread for us to look at.  Thanks...pskelley

    http://www.russelltexas.com/malware/malware.htm

  • N

    nucleart

    2 Posts

    518

    0

    Posted July 5th, 2004 02:00

    PSKELLY,

     

    Thanks for your response.  I am at a remote location, but will follow your instructions ASAP and will post the new information.  Thank you.

    Nucleart

  • M

    megageek

    1 Message

    518

    0

    Posted July 8th, 2004 06:00

    I run win 2000 on my laptop and picked up this nasty little highjacker.  After trying every other solution posted (which all seemed to be for XP) and running spybot, ad aware, cwshredder, killbox, security task manager and highjackthis more than once, I finally found this posting and it did the trick.  Try this:

    http://www.computing.net/security/wwwboard/forum/12316.html

    see response number 5 - if you can believe it there is an uninstaller that actually has seemed to work so far.

    Also, I was able to open a DOS window, go to c:\windows\system32 and run an attrib -r wdm.dll (name of my hidden dll), rename the file and delete it.  I still had the problem though until I ran the uninstaller.

  • B

    baskar1234

    181 Posts

    518

    0

    Posted July 8th, 2004 08:00

    Hello,

    Thats a nasty hijacker and there is a special method of removing it.

    Download and install :

    "FINDnFIX.exe" from

    http://downloads.subratam.org/FINDnFIX.exe

    Run the "!LOG!.bat" file, wait for the final output (log.txt)
    post the results....

    Regards

Dell Support Resources

Latest Solutions

View More