Please help! I can't kill these hijackers!!

Hello,
I recently found the CWS.Feads and PeopleonPage hijackers in my Ad-aware scans. The Spybot and Norton scans always come out clean. When I delete them from Ad-aware they magically reappear the next time I log on

I followed the instructions in the How to: Spyware, Trojan And Virus Removal thread, and everything came up clean. Although when I downloaded Pest Patrol from your site, it did find the hijackers plus a few more issues

Any suggestions?

Thanks!
D~

 

• Download HijackThis 1.99.1

• Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

• Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file.

• Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

• Run HijackThis and save your log file.

• Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post).

• Need help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

Thank you so much!! Here is the log.

D~

 

Please look in Add or Remove Programs for the following and Uninstall them if found:

NZSearch

CSBB

Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.



Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:

cnvcint.exe

cfgenb32.exe

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch

R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\Program Files\NZSearch\SearchEnh1.dll

O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)

O4 - HKLM\..\Run: [tzvsppebku] C:\WINDOWS\System32\sehiyu.exe
O4 - HKLM\..\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe
O4 - HKLM\..\Run: [uF8h3ET] cnvcint.exe
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - HKCU\..\Run: [fornROf2X] cfgenb32.exe

O15 - Trusted Zone: *.awmdabest.com (HKLM)

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\Program Files\NZSearch ←–– Delete this whole folder if it exist!

C:\Program Files\CSBB ←–– Delete this whole folder if it exist!

C:\WINDOWS\system32\cfgenb32.exe

C:\WINDOWS\system32\cnvcint.exe

C:\WINDOWS\System32\sehiyu.exe


NEXT:
Run CCleaner

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

Reboot to Normal Windows , Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Good Luck!

 

Thanks again I followed all of your instructions with no problems. Everything seems to be running ok, although I have not re-run any of the scans yet.

Here is the second log you requested.

D~

 

Log is clean my friend Almost done...

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.


Are you currently having any further problems?

 

Okay.....I reset the web and security settings like you said. I ran Ad-aware, Spy bot etc, and everything was clean. Then I ran PestPatrol and the same crap came up again

I could not copy or save the PestPatrol log so I'll enter all this in by hand, but this is what is showed me:

CWS FEADS - In registry HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_*008f*0010%af*00e5*003*0017*

Peopleonpage - In registry
HKEY_LOCAL_MACHINE\software\autoloader

PeopleonpageApropos - In registry
HKEY_CLASSES_ROOT\clsid\{b5ab638f-d76c-415b-a8f2-f3ceac502212}\progid

PeopleonpageApropos - In registry
HKEY_CLASSES_ROOT\clsid\{b5ab638f-d76c-415b-a8f2-f3ceac502212}\versionindependentprogid

Apropos Directory - In Directory
C:\Program Files\cxtpls

Unknown (Author clearsearch loader) - In File
C:\WINDOWS\bundles\csv10p070.exe

Unknown (Author mysearch toolbar) - In File
C:\WINDOWS\bundles\s4Sept.exe

Unknown (Author Betterinternet Inc.) - In File
C:\WINDOWS\bundles\thin-8-1-xx.exe

Unknown (Author Spylabs, Inc) - In File
C:\WINDOWS\bundles\wrapperouter.exe

Unknown (Browser Helper Object) - In File
C"\WINDOWS\system32\cache\cxfpls_loader.exe



Thanks!
D~

 

Download and install Microsoft® Windows AntiSpyware during the install make sure you get any updates BUT BEFORE YOU START THE SCAN: Print or save these instructions locally now because you will have to be disconnected with no browsers open in the following steps.

Please make sure ALL Browser Windows are Closed and also you should physically disconnect from the Internet by unplugging your cable. Do not reconnect or open a browser again until requested.

Now allow the Microsoft Antispyware program to run a full scan. After it completes, reboot again in normal boot mode.

Let me know how things are after you do the above!

 

Many thanks bj, you rock! The Microsoft AnitiSpyware detected and killed everything except the CWS.Feads adware

When I ran PestPatrol again the CWS.Feads was the only thing that came up this time. When I went to look for it's location in the registry:

CWS FEADS - In registry HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_*008f*0010%af*00e5*003*0017*

I did find it, but I could not delete it or change it in any way. I read online that this is one of the most nastiest bugs to kill if it can be done at all, and that reformatting may be your only option........sigh...I hope not.

Do you think that if I installed the full version of PestPatrol that it might actually help?

D~

 

Nah, we will get it! Trust Me

Okay, Now lets try the below before we go any further.

Download & Run CWShredder 2.14

If this doesnt do the job then procede with the next step:

Download, Install & Run SpySweeper.

Download SpySweeper Here!

Note: Be sure you updated definitions before doing a full sweep.

Let me know the results!

 

Alright, I followed your instructions.... I ran CWS Shredder, and everything came up clean. Then I downloaded Spy Sweeper, and surprisingly it came up with 6 fragments of bugs that I thought I had removed. So they are gone.

But the CWS. Feads still remains

Thanks,
D~

 

Take a look at this link and scroll thru it. Follow as many steps as possible that apply to you.

http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453086128

Let me know the results!

 

I went through all the etrust info, and I couldn't find any of those files, etc.

But I also went to the location of the CWS.FEADS in the registry:

CWS FEADS - In registry HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_*008f*0010%af*00e5*003*0017*

and I right clicked on it, then clicked the permissions tab, I denied access to the SYSTEM and to EVERYONE. Then I immediately ran the scans, and this time the CWS.FEADS didn't come up at all

I don't know if I made things better or worse, but I am assuming I will need access to this thing to kill it.

Thanks,
D~

 

If this is the EXACT registry key, procede!

Copy the contents of the Quote Box below to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file cwsfix.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.)

Double-click on the cwsfix.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to merge, click YES!

 

Ok, after I clicked merge and yes, I get this message:

Cannot import C:\Documents and Settings\Home\Desktop\cwsfix\.reg:
The specified file is not a registry script.
You can only import binary registry files from within the registry editor.


huh?
D~

 

Copy the contents of the Quote Box below to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file cwsfix.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.)

Double-click on the cwsfix.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to merge, click YES![/QUOTE]

 

Bad news.... after I did the merge this time it was accepted, and I thought everything was okay until I changed the permissions back to allow access, and ran the scans..... CWS.FEADS still there!

D~

 

Give me the exact registry keys for the found infections.

 

SUCCESS!! Cool it worked.

Here is the exact key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_*008F*0010%AF*00E5*0003*0017*001A*00A4*00B6*00C0*00A8

I must have missed a number before , so I redid the cwsfix.reg and the CWS.FEADS is gone.

A million thanks to you, and all your help! Although I have one more issue, I don't know if I am in the right forum, I tried to uninstall a PC game today and I keep getting a "cannot find SHELL.DLL" error message, could this have been damaged or corrupted by the spyware, etc?

D~

 

For the uninstall, navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Look for the program name, right click and delete it!
Exit Registry Editor

Now, go into the following directory:

C:\Program Files

Search for and delete any folders relating to the game.

After doing this, it should be gone

 

Everything seems to be clean here, I am a happy girl!

I will enable my system restore now and keep my fingers crossed.

Thanks again for the help, you guys are the best




D~

 

Good Deal!

You should see this article on How to Protect yourself from malware!