"Only the best" - HSA hijack...

In short no! That's because there are literally dozens of variations of the hijacker and it mutates and spreads on the fly, especially when incorrect/incomplete cleanup procedures are attempted. There a a variety of tools out there the say they remove this hijacker. None of them do. At least none of them will always work on all forms. Some tools will help with minor forms of the infections.

The Generic Procedure was started along time ago and always worked to help fixed the problems. It evolved to add in some tools that others developed as time went on and the hijacker itself was evolving and getting more insidious and difficult to remove. We have had some luck lately using some other procedures but they are written on an individual user PC basis after determining the exact state of the infection. This takes more time on our part. Running the Generic Procedure for the forms of the hijack that it addresses, works for everyone and saves us time.

If this was an easy thing to fix, antivirus and spyware removal tools would have had fixes long ago. Complex problems require complex solutions. However there are several hundred fixes (probably more than that) that have been applied in this forum. Some are shorter than others. It all depends on the level and type of infection.

Please follow the steps below. While the READ ME FIRST will not necessarily fix the hijacker, it helps to get you into a know state and also has steps related to the hijacker that also help to get the repair started.

- Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

 

Do you really believe would would have procedures here that could physically damage your hard disk? If we did, this forum would have been gone a long time ago.

System Restore points are of no use to you once your system has become infected. You do not know what is actually in each of the restore points. They could be infected themselves. They could even have older problems that you have already fixed.

Note: however you can try using system restore to bring your system back to a point before this infection occurred (if you can pin point that date/time). You will loose other registry setttings/configurations for things you have added/changed/installed since that point in time too. It's up to you.

 

There can be many files having ADS on your system. Many can be legitimate. You have to be very careful using Ad-Aware ADS or ADS Spy mentioned in the READ ME FIRST. You must know what you are doing and how to identify bad from good which is not always that easy.

Spybot Hosts List tool is of no help for this problem.

 

Yes they are bad services that are only associated with the hijacker problems. Some forms of the hijacker do not use these services, so they may not always be found.

 

Please just follow the steps given to you in message # 2. We will get to all of the problems eventually. Some of the things you mentioned are part of this infection. Complete the steps of the READ ME FIRST and then move on to posting the HijackThis log as requested so we can get to work on fixing you up.

After posting your HJT log, it is critical that you do not reboot or power down. Also do not make any attempts to run other procedures or scanners to fix anything. Doing this can make the problem spread and mutate which would make any fix I would provide a waste of time.

 

Using system restore does not delete files or restore files. It basically just changes registry settings which can make installations/uninstalls look like they were never done even though the file status itself has not changed. It would not affect files you downloaded. It does require re-installing and reconfiguring your settings. It's up to you what you want to try.

No I do not need any logs from Ad-aware.

Complete the steps from the READ ME and post your HJT log.

 

Let's fix the problems. If you look in current threads, I'm working quite a few of these right now.

Already answered in message number 8.

You are wasting alot of time. We could be just about done already.

 

Look at my profile under occupation!

 

That's because there are multiple processes associate with the hijacker and they all watch out for each other. That way they can respawn when you shut down other processes or services. Just complete all the rest of the steps in the READ ME FIRST. Make sure you run About:Buster and HSremove as indicated. When finished with the READ ME FIRST. Post your HJT log so we can identify all the processes related to the hijacker.

 

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\WINDOWS\javanp.exe

After killing all the above processes, click the "Back" that is 3 buttons to the right of Kill Process and just leave HijackThis running.


Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
On the page that opens, scroll down to Workstation NetLogon Service (or if you cannot find that name, try the short name 11Fßä#·ºÄÖ`I ) ... right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.


Next, go back to your HJT windows and select 'Delete an NT Service" Now copy/paste the following into the box that opens, and press "OK":

Workstation NetLogon Service

If that does not work, copy and paste in the short name: 11Fßä#·ºÄÖ`I
You have to copy and paste because these characters are not easily entered.

After doing that exit HijackThis. We will be restarting HJT in a couple of lines though.

Now please download the following tool: Pocket KillBox

Extract Pocket Killbox to its own folder but do not run it yet. We will need it later.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis again and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes. (I double checking to make sure they are not running again - now matter what happens here, just continue):
C:\WINDOWS\javanp.exe
C:\WINDOWS\winsq32.exe

After killing all the above processes, click "Back".
Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\dpsjp.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\dpsjp.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\dpsjp.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\dpsjp.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\dpsjp.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\dpsjp.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {F8254D4D-78D5-68D0-643E-BC89D9755ADE} - C:\WINDOWS\crbv.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing)
O4 - HKLM\..\Run: [javanp.exe] C:\WINDOWS\javanp.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\winsq32.exe <-- this line may or may not be found. It depends on what happened in previous steps.

After clicking Fix, exit HJT.

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now run Pocket Killbox.

Now, Copy and Paste C:\WINDOWS\crbv.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\javanp.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the RedX and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\winsq32.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your PC to reboot.

If you get an error message about Pending Operations, just reboot your PC yourself.

Now get a new HJT log and post it here. And tell us how these steps went and how things are working.

Also DO NOT REBOOT OR POWER DOWN after posting your log. If you are still infected, this can cause it to mutate and spread making any following fixes I suggest a ineffective.


By the way if you do not use the Viewpoint crap from AOL (most people do not), just go to Add/Remove programs and uninstall them.

 

Describe what you mean by you cannot get it to work. Does this mean that you get an error message? If so, what is the message. Or do yo mean nothing happens? Or something else?

It will not work if you have not done the below:

Unless the Service is both stopped and disabled, HJT cannot Delete the NT service.

If you still cannot get this step to work properly, just continue with the other steps and we will see what happens in the follow up HJT log.

 

As stated in my last message:

 

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\wjudf.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\wjudf.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\wjudf.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\wjudf.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\wjudf.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\wjudf.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {943544B1-5A24-1DF9-55CE-89DC02154188} - C:\WINDOWS\system32\iewv.dll
O2 - BHO: Class - {F8254D4D-78D5-68D0-643E-BC89D9755ADE} - C:\WINDOWS\crbv.dll (file missing)
O4 - HKLM\..\Run: [javanp.exe] C:\WINDOWS\javanp.exe

After clicking Fix, exit HJT.

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now run Pocket Killbox.

Now, Copy and Paste C:\WINDOWS\system32\iewv.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\javanp.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your PC to reboot.

If you get an error message about Pending Operations, just reboot your PC yourself.

Now get a new HJT log and post it here. And tell us how these steps went and how things are working.

PLEASE DO NOT REBOOT after posting your log. If you are still infected, it could mutate making the next steps I would post ineffective.

 

Those are all bad files and need to be deleted (in safe mode). Many of them are related to your HSA hijacker problems.

Sorry I have not been around for a couple of days. Is your last HJT log still correct? Meaning does a current log still look exactly the same?

 

No! Any account can become infected even if it has not been used! You should check them to be safe.

 

You can fix them any way that works. Just make sure they get removed.

Every user on a PC has their own folders and registry settings, you need to clean them while logged in as that user. Yes, you can remove the user accounts if desired. Make sure no info (like file folders etc) remain for those accounts afterwards.

Your last log was clean, that's why I asked if it is still the same. Are you having any problems (other than those remaining files to delete)?

 

Okay! The real test of making sure the hijacker is gone is to open and close a couple Internet Explorer browser sessions. Do that after removing those other files.

 

All you HJT logs are clean. Just fix the left over lines from HSremove. Any of these type lines:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm

The file Norton is showing seem to be an ADS file. Try running ADS SPY and see if it finds it.

Note: ADS spy also displays legitimate ADS streams. Don't delete streams if you are not completely sure they are malicious! You should consult with an expert before deleting any files with this tool.


For the HSA hijacker related items in your registry, try the registry patch below.

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixhsa.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixhsa.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

 

If you do not use the below, then uninstall them via Add/Remove programs:
Viewpoint Toolbar
Viewpoint Manager
AIM

If you do not use Windows Messenger, run the below:
Disable/Remove Windows Messenger

Do not touch the below:
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll

Do you use RealPlayer? The below is related to it.
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

If you do not use RealPlayer, look in Add/Remove programs for it and uninstall it.

 

Run regedit and navigate to the below key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

How are Internet Optimizer and Shopping Wizard listed? Are they spelled out or abbreviated?

 

Just be aware that if you install any AOL software including AIM, the Viewpoint stuff will come back and you will have to uninstall it again. Yes you can manually delete the Viewpoint folder.

Try manually delete all the related registry keys for OfferOptimizer and ShoppingWizard.

 

You're last log indicated that you were clean at that time. So now that the registry entries have been fixed, it is time for you to work thru the steps of the below thread to help keep you clean:

How to Protect yourself from malware!

 

The SDhelper function of Spybot is okay to use.

Consider whether you want another full blown spyware blocking program like Microsoft® Windows AntiSpyware (which is free right now) or Spy Sweeper (which is not free).