browser hijacked? smartfinder?

Please follow the steps below:

- Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

 

Fix all the problems Trend Micro found yourself (if possible in safe mode). Just continue through all the remaining steps of the sticky thread and post your HJT log (if necessary) when finished with the remaining steps.

 

Logs should always be from normal boot mode unless reuqested otherwise!

Please download the following tool: Pocket KillBox

Extract Pocket Killbox to its own folder but do not run it yet. We will need it later.

Let's try a simple approach to fixing you HSA infection. This may or may not work. Depends on whether there are other hidden processes that we are not seeing right now.

Print the below steps or save them locally. And then disconnect from the internet and close ALL browsers sessions before continuing with the steps below.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.

C:\WINDOWS\system32\appxj32.exe

After killing all the above processes, click "Back".
Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\rfbzo.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rfbzo.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\rfbzo.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\rfbzo.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rfbzo.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\rfbzo.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {FEB83F4D-CC42-5BB2-2F5F-FF52E5B474D5} - C:\WINDOWS\crvy32.dll
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [winia.exe] C:\WINDOWS\system32\winia.exe
O4 - HKLM\..\Run: [appxj32.exe] C:\WINDOWS\system32\appxj32.exe
O4 - HKLM\..\RunOnce: [addvt.exe] C:\WINDOWS\addvt.exe
O4 - HKLM\..\RunOnce: [netln32.exe] C:\WINDOWS\netln32.exe
O4 - HKLM\..\RunOnce: [d3df32.exe] C:\WINDOWS\d3df32.exe
O4 - HKLM\..\RunOnce: [mfczh.exe] C:\WINDOWS\system32\mfczh.exe
O4 - HKLM\..\RunOnce: [netii32.exe] C:\WINDOWS\netii32.exe
O4 - HKLM\..\RunOnce: [mfcjk.exe] C:\WINDOWS\mfcjk.exe
O4 - HKLM\..\RunOnce: [sdkvm.exe] C:\WINDOWS\sdkvm.exe
O4 - HKLM\..\RunOnce: [syszu32.exe] C:\WINDOWS\system32\syszu32.exe
O4 - HKLM\..\RunOnce: [winqg32.exe] C:\WINDOWS\system32\winqg32.exe
O4 - HKLM\..\RunOnce: [netpf.exe] C:\WINDOWS\system32\netpf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: World Poker Exchange - {76028735-BBF1-4044-8DE2-5B90F0C7A77C} - C:\Program Files\WorldPokerExchange\GameClient.exe (file missing)
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\addvt.exe" /s (file missing)

After clicking Fix, exit HJT.

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now run Pocket Killbox.

Now, Copy and Paste C:\WINDOWS\crvy32.dll into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\system32\appxj32.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\addvt.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\system32\winia.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\addvt.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\netln32.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\d3df32.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\system32\mfczh.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\netii32.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\mfcjk.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\sdkvm.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\system32\syszu32.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\system32\winqg32.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\system32\netpf.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your PC to reboot.

If you get an error message about Pending Operations, just reboot your PC yourself.

Now get a new HJT log and then reconnect to the internet and post your log here. And tell us how these steps went and how things are working.

PLEASE DO NOT REBOOT after posting your log. If you are still infected, it could mutate making the next steps I would post ineffective.

 

See the READ ME FIRST and look at step number two of Getting Prepared. You may need to stop and disable the below service first.

O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\addvt.exe" /s (file missing)

You may have use the short name, 11Fßä#·ºÄÖ`I

Let me know if you have any problems finding this service. Note per the READ ME, this service could be any of three names. It can change the service name on the fly.

 

First answer a question. Have you rebooted or powered down since posting you last HijackThis log. If so, after trying the below steps, you will have to post a new HJT log and do not power down or reboot again until I tell you to do so.

Download and install Unlocker 1.65
Accept all the install default settings.

Now open Windows Explorer and navigate to C:\WINDOWS\system32\appxj32.exe
And right click on the file name and select Unlocker
A Window will pop up showing some information about the locked file and which Process Paths are using it. Make sure you write down the info so you can tell me later what you saw. Then click Unlock All Now Kill the process! Did that work?

If necessary, post your new HJT log.

 

Did the Unlocker window come up and show the appx32.exe process?
What items did it show that where locking it?

If Unlocker cannot kill it and HijackThis's process manager cannot kill it either, Task Manager will not be able to. And in some cases Task Manager cannot even find these processes.

OKAY! I hope you are remembering not to reboot or power down now???

Do you see how much wore your problem has become? See all the new O4 processes that are loading and running. We are going to have to take a slightly different approach. We will not use Killbox to start.

You should uninstall BearShare unless it is the paid version! The free version brings malware to your PC. See: http://www.spywareinfo.com/articles/p2p/

 

Okay I'm going to have to post a cleanup procedure in multiple messages. It is way to long to get it to post in one message. Make sure you print or save the procedure locally and run it while offline as indicated.

Now I want you to run completely through the below steps and do not stop if you get any error messages or cannot kill a process. You must simple ignore it and continue.

First stop and disable the below service again (do not look back again to see if it changes to automatic - just continue with all the steps):
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\addvt.exe

Print the below steps or save them locally. And then disconnect from the internet and close ALL browsers sessions before continuing with the steps below.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.

C:\WINDOWS\system32\appxj32.exe

 

After killing all the above processes, click "Back". Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

Okay the list was still to long to post in a message so I am attaching the list of lines to fix with HijackThis. The first attachment is hsafix1.txt.


After fixing those lines exit HijackThis.

Now reboot into safe mode and run Windows Explorer. Locate the below files and delete them. (Note you will see duplicates below. That is because I simply copied and pasted from your HJT log and it would take to long to edited. Once you delete the file obvioulsy it will not be there againg. Just skip and continue.)


Okay attachment two is hsafix2.txt. It is the list of files to delete.

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file. If it will not delete, note the name (tell me later when you come back) and continue.


Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.



Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.


Now reboot in normal mode and post a new HJT log. And tell us how things are working. DO NOT REBOOT OR POWER DOWN AT THIS POINT! You must wait for the next instructions to be given.

 

Do what I gave you in messages 17 & 18? I hope that you had not rebooted since posting your log. It is critical that when I say not to reboot, that you do not reboot.

 

It's not hopeless. But you must follow instructions exactly. I have no idea what you are doing because you are not giving me any feedback on steps and instructions. For example, even now I have no idea if you have no powered down or rebooted your PC. A fix will not work if you have. If you had simple said after posting your log, "I'm leaving my PC on now waiting for instructions" I would know.

You also gave now feedback on the previous instructions and whether you power down or rebooted before running them. You also told me nothing about any of the steps.
Did they run OK?
Did you find everything I mentioned?
Did you stop and disable the Network Security Service as requested?
Did everything delete okay......etc.

I'm not sitting there with you. You must tell me what is happening. I need to know you are not having or are having problems and I need to be confident that you are following instructions exactly.

We did make some progress. At least your log is quite a bit smaller right now since we got rid of many of those O4 processes.

So before I give the next steps I need you to answer the above and also tell me if you have powered down or rebooted since posting your log. If you have, post a new log and do not power down or reboot again. Also tell me that you will not power down or reboot so I know.