CoolWebSearch Removal

Welcome to Majorgeeks!

You must follow standard cleaning steps before posting HijackThis logs.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

.

 

You must run ALL steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support before posting HijackThis logs.

And you should not be using msconfig:

O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder

 

No you have not! You did not run CounterSpy! And you did not do any of step 6.

Read all the instructions in the link given in step 7 again. Msconfig is discussed there.

 

Well partially.

You did not post the BitDefender log as in the instructions in step 6. You posted the log summary which only gives virus names and not where it is finding them.
Did you really run BitDefender? It does not appear in your HJT log like it should.

Also it still appears that you are running msconfig to control startups. Did you follow the directions in step 7 to select Normal Startup?

Make sure viewing of hidden files is enabled (per the tutorial).

Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Look for the below process(es) and if found, End them:
C:\WINDOWS\IHBHDAAA\COMMAND.EXE

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
O4 - HKLM\..\Run: [Command] C:\WINDOWS\IHBhdAAA\command.exe
O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-110-12-0000080.exe

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Program Files\DNS <--- the whole folder
C:\WINDOWS\SYSTEM\SBUtils <--- the whole folder
C:\WINDOWS\IHBHDAAA <--- the whole folder
C:\WINDOWS\banmanpro.exe
C:\WINDOWS\SYSTEM\Quicklinks.exe
C:\WINDOWS\Temporary Internet Files\Content.IE5\GZI1Y34N\maxifilesdns[1].zip
c:\program files\common files\services.exe
c:\program files\common files\system32.dll
C:\Program Files\Common Files\mc-110-12-0000080.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now we need to Reset Web Settings:

1. If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2. Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3. If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log.

Make sure you tell me how things are working now.

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

Looks like you have a bunch of new problems! Where have you been surfing since last time?

Do you really need to play all of those silly online games that put all those cab files on your PC?

 

Make sure viewing of hidden files is enabled (per the tutorial).
Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Look for the below process(es) and if found, End them:

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O4 - HKLM\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKLM\..\Run: [lspins] "C:\WINDOWS\SYSTEM\igps.exe"
O4 - HKLM\..\Run: [winsysupd] C:\WINDOWS\WINSYSUPD5.exe
O4 - HKLM\..\Run: [winsysban] C:\\WINSYSBAN5.exe
O4 - HKLM\..\Run: [gimmygames] C:\\GIMMYGAMES.exe
O4 - HKLM\..\RunServices: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKLM\..\RunServices: [PVJV0] C:\WINDOWS\TEMP\PVJV0.EXE
O4 - HKLM\..\RunServices: [JPGX1] C:\WINDOWS\TEMP\JPGX1.EXE
O4 - HKCU\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe


After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\SYSTEM\windir32.exe or C:\WINDOWS\windir32.exe
C:\WINDOWS\SYSTEM\igps.exe
C:\WINDOWS\WINSYSUPD5.exe
C:\WINSYSBAN5.exe
C:\GIMMYGAMES.exe
C:\WINDOWS\TEMP\PVJV0.EXE
C:\WINDOWS\TEMP\JPGX1.EXE
If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST)[/b].

Make sure you tell me how things are working now.

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

If you do not want any games, uninstall them. If you mean those online games I referred to, just add those O16 lines to the list of things to fix with HJT in my previous message.

You need to complete the instructions in my previous message.

 

Which files didn't you find?

Attach a new HJT log (I forgot to ask for one as a follow up).

How are things working now?

 

If you finished deleting whatever files you could find, the next step was to run Ccleaner so run it if you have not already done so. After that attach a new HJT log.

Note for your education if not known, Windows XP Search will not locate hidden or system files unless configured correctly. See the below:

Searching for Hidden Files on WinXP

 

You log is clean now! If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!

As far as other processes go, everyone runs & uses different things on their PC. Only you can really decide what you need based on your own use. You could research the below processes on google and decide for yourself whether you want them to run at startup or not:


O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\motmon.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [HPLogiFinder] \WINDOWS\OPTIONS\CABS\LOGITECH\HP_FINDER.EXE
O4 - HKLM\..\Run: [Lexmark 5200 series] "C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s