Google highjack...

The proper fix is to remove the WareOut infection and then reset the DNS setting.

See this sticky thread: WareOut Removal


If you don't remove the source, you are only bandaiding the problem and it could come back.

 

You're welcome. There are many forms of WareOut infections. Some are much worse than others. The bad ones really need that procedure and even then there can sometimes be a few leftover .exe files that need to be manually deleted.

 

See that! This procedure found more problems!

Yes you need to delete the below files:

C:\WINDOWS\SYSTEM32\CSBNI.EXE
C:\WINDOWS\SYSTEM32\DMPFW.EXE

And you need to fix any other associated O17 lines with the 85.x.x.x number from your HJT log. However note, we do not except HJT logs here without our full cleaning procedures (in the READ & RUN ME sticky thread) being followed.

 

You did not attach the required CounterSpy logs or the BitDefender logs!

You did not fix the O17 lines as I indicated! There is also a left over O20 line from uninstall Spy Sweeper which you can fix too.

After fixing, reboot and attach a new HJT log for this first PC!! Let's work only on one PC at a time to avoid any confusion.

You need to install a current Sun Java & update your FireFox version on this PC.

Sun Java Runtime Environment

Mozilla Firefox

 

Okay this PC appears to be clean. Are there any other malware problems with it?

If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
8. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!

 

Now attach the CounterSpy and BitDefender logs for dining room PC and explain what problems it is having.

 

I agree!

No not always true! HijackThis quite often tells you something is missing when it is not.

You only have on item in this PC that you should fix with HJT. Fix the below line:
O16 - DPF: {11111111-1111-1111-1111-111111111732} - file://c:\progra~1\pl.exe

And then look for the below file and delete it if found.
C:\Program Files\pl.exe

If this PC is not having any other problems, you should uninstall some of the antispy software. Like CounterSpy and Windows Defender. You have SpywareGuard running and should not keep the others installed.

Attach the CounterSpy, Bitdefender and PandaScan logs for the laptop.

 

Okay we just have a few minor tweaks to make on the laptop.

First uninstall the CounterSpy trial as it is no longer needed and you have AOL Antispyware installed.


Uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 9
Viewpoint Media Player <-- should have been uninstalled in step 0! If it refuses to go away use this: ViewpointKiller

Now install the current version of Sun Java from: Sun Java Runtime Environment

Now some minor tweaks to improve performance!

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
After clicking Fix, exit HJT.

If Windows Messenger (the msmsgs.exe file) will not stay gone, use the below to remove it:

Disable/Remove Windows Messenger


For all PCs, make sure the below is followed!

If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
8. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!

 

Uninstall CounterSpy! It is only a 15 day trial that will not work after 15 days anyway. I don't have too much personally experience right now with CyberHawk and Sandboxie but they are getting some good feedback. We do have both available on MGs which means they meet with our approval. You can find them here:

http://www.majorgeeks.com/Sandboxie_d4993.html
http://www.majorgeeks.com/Cyberhawk_d5190.html