Member Panel


Sponsors and Ads

Live Tag Cloud

PC Forum PC Help Forum » Security & Safety » [Fixed] Hijackthis! Logs » [Resolved] CoolWWWSearch won't go away!

[Fixed] Hijackthis! Logs - [Resolved] CoolWWWSearch won't go away! posted in the Security & Safety forums; Have done a few Spybot S & D scans and this keeps coming up: Win32.Agent-gen.cws C:\\WINDOWS\netvb32.exe C:\\WINDOWS\crtz.exe C:\\WINDOWS\apiyg.exe I tried going to the folder and manually deleting them, no sucess, ...

JOIN US NOW to remove these Ads

Post New Thread  Reply
  #1  
Old 11-04-2006
HelpPlease's Avatar
Bronze Member
 
Join Date: Sep 2006
Posts: 20
HelpPlease - See this Members User comments on their Profile page
Default [Resolved] CoolWWWSearch won't go away!

Have done a few Spybot S & D scans and this keeps coming up:

Win32.Agent-gen.cws

C:\\WINDOWS\netvb32.exe

C:\\WINDOWS\crtz.exe

C:\\WINDOWS\apiyg.exe

I tried going to the folder and manually deleting them, no sucess, SpyBot could not delete them and also indentified them as Cool Triple WWW Search Trojan.

CoolWW W SearchFeat2Installer
Cool WW.W SearchService and CoolWW.WSearchFeat2DLL


  #2  
Old 11-04-2006
madmonkey's Avatar
Site Manager
My PC
 
Join Date: Oct 2006
Location: South Wales
Posts: 5,536
PC Experience: PC Basket Ball Head!
madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page
Default

Hello "HelpPlease",

Please can you follow the link on my signature to "PCHF Prework" and post your AVG and Hijackthis log back here. A member of the security team will then analyze your log and post a fix for you shortly after.


__________________

Free Links: Hit Counter.. - ..Form Mail.. - ..Games.. - ..Amuz'd.. - ..Psychometrics Online.. - ..myFavorites Homepage
Submit your URL or Blog to: cyberJuice USA / UK online shopping links and blogs.
  #3  
Old 11-04-2006
HelpPlease's Avatar
Bronze Member
 
Join Date: Sep 2006
Posts: 20
HelpPlease - See this Members User comments on their Profile page
Default

OK did both. Here is the HiJack this log

Logfile of HijackThis v1.99.1
Scan saved at 2:25:50 PM, on 11/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = ViewSonic - The Choice of Professionals
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 9.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab47946.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DigiChat 4.0 Server (DigiChat_4.0_Server) - Unknown owner - C:\PROGRA~1\DIGICH~1.0\DIGICH~2.EXE (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe



Last edited by HelpPlease; 11-04-2006 at 08:32 PM.
  #4  
Old 11-04-2006
HelpPlease's Avatar
Bronze Member
 
Join Date: Sep 2006
Posts: 20
HelpPlease - See this Members User comments on their Profile page
Default

And here is the AVG Anti-Spyware: (too long to post)

Uploading.com - The best file hosting service! - Report-Scan-20061104-141815.txt -


  #5  
Old 11-04-2006
madmonkey's Avatar
Site Manager
My PC
 
Join Date: Oct 2006
Location: South Wales
Posts: 5,536
PC Experience: PC Basket Ball Head!
madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page madmonkey - See this Members User comments on their Profile page
Default

Thanks "HelpPlease", I will transfer this to the hijacklog section.


__________________

Free Links: Hit Counter.. - ..Form Mail.. - ..Games.. - ..Amuz'd.. - ..Psychometrics Online.. - ..myFavorites Homepage
Submit your URL or Blog to: cyberJuice USA / UK online shopping links and blogs.
  #6  
Old 11-05-2006
chiaz's Avatar
Senior Security Analyst
 
Join Date: Jun 2006
Location: Singapore
Posts: 2,511
PC Experience: PC Guru
chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page
Default

Hello.

Please read the complete post first, you should copy and paste this post to a new text Document or print it.
Download and install CCleaner.com

Download and install Adaware, uncheck "show help file" and "perform full system scan" at the end of the installing routine, perform the update and close Adaware. You will need it later.

Download and then double click http://cwshredder.net/bin/CWShredder.exe. Then close every window and disconnect from Internet, double click the CWSshredder icon on your Desktop.
Click Fix, ok and then Next, let it fix everything it asks about.

Run HijackThis
Click on scan and put a check on the following lines, if they are still there:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

Make sure all open windows are closed and click on Fix Checked.

Start Ccleaner and click: Run Cleaner.
Run Adaware and perform a full system scan.
Reboot and post a new HijackThis log, as well as the Adaware log.



Last edited by chiaz; 11-05-2006 at 02:48 AM.

Reply
New! Norton Internet Security 2008 – Download Now Click Here

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are On


All times are GMT +1. The time now is 10:48 PM.
Powered by vBulletin
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.2.0 RC7
All Graphics & Content Copyright © 2004-2008 - PC Help Forum.com


Back to Top