Help removing CoolWWWSearch.Aboutblank and IE Plugin

strider1722 · Nov 26, 2005

Hi. I'm trying to fix my aunt's computer and was able to clean of the majority of the adware, spyware, and viruses that she had. However, I am still getting results of CoolWWWSearch.Aboutblank and IE Plugin after a scan with Spybot. Any help would be greatly appreciated! Thanks.

strider1722 · Nov 26, 2005

Here is the Hijackthis log file attached.

strider1722 · Nov 26, 2005

By the way, I also forgot to mention that I have had problems running Firefox on her computer after I downloaded it. It opens but nothing shows up even though the internet is connected. MSN explorer was working yesterday, but now even though it seems won't connect. So for today I've been forced to use IE and pop-ups are showing up again. I tried logging on to my multiple email accounts to send the hijackthis file from her computer to mine, but each one pulled a "Page not found" when I tried to get to the inbox. Very strange I thought, but I eventually got it through using AIM's send file function.

chaslang · Nov 26, 2005

You have a bunch of problems.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Please follow the steps below:

- look in Add/Remove programs for TopSearch and uninstall if found

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
Make sure you pay attention to step 3 too, because you have multiple antivirus applications installed.

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

.

chaslang · Nov 26, 2005

After completing the steps in my previous message and posting a new HJT log as an attachment, continue with these steps. We need to locate some hidden files related to additional problems you have.

Please run Panda Online Scan. After the scan attach the log to your next post. Also please follow the below:

1 - Please EXTRACT all files from Qoologic Tool to its own folder - C:\Program Files\QoologicFinder . Then, DoubleClick Find-Qoologic.bat to run the tool. It should produce a log - Please attach that with your next post!

2 - Please EXTRACT all the files form RKFiles Tool to its own folder named C:\Program Files\RKTOOL. Then, Please boot to SAFE MODE and DoubleClick rkfiles.bat to run the tool. Let it run and then, when it finishes, look for a log at C:\Log.txt and please attach that log.

Now come back here and post all three logs as attachments. This will require two messages because only two attachments per message are allowed.

strider1722 · Nov 26, 2005

HELP!!! Was running the malware removal tools in safe mode and it froze while scanning with Microsoft Antispyware. Ctrl Alt Del pulled up the dreaded blue screen and now it won't even boot. Just comes up as "A disk read error occurred Press Ctrl + Alt + Del to restart." I'm worse than I was before. Please help.

chaslang · Nov 26, 2005

Please tell me exactly which steps you ran and also the order in which you ran them. Also indicate as best as you can what happened at each step.

Are you sure MS Antispyware was hung? How long did you wait before assuming it was hung?

Did you try powering down, wait, and then power up?

Do you use any special harddisk partitioning or setup software? What size harddisk is it?

Does the drive show up properly in the BIOS?

strider1722 · Nov 26, 2005

I followed the steps in order as listed. I uninstalled AVG since it said to only have one antivirus, and I kept avast. I rebooted in safe mode, ran CCleaner and it cleared some things, ran Ad-Aware it it cleaned a few more, ran Spybot and it fixed IE Plugin, and then ran MS Antispyware. I waited for a few minutes, and the mouse was not moving, so I'm pretty sure it was frozen. Also, like I said, ctrl alt del didn't bring up the task manager, and I pressed it again and it brought up a blue screen, then tried to restart and came up with the message I quoted. The hard drive is showing up in the BIOS, but I don't know what size it is because it's not my computer. Is there any hope? I think she's just going to have to take it in to get it fixed, but I feel terrible because I had most of the malware cleaned off, she was getting only a few popups, and now it won't even boot.

strider1722 · Nov 26, 2005

Ok I went into the boot setup and I think it's a 30 GB hard drive. It says internal hard disk 30006 MB, and it says ST93015A-(PM) on a Compaq notebook if that helps.

chaslang · Nov 27, 2005

strider1722 said:

I think she's just going to have to take it in to get it fixed, but I feel terrible because I had most of the malware cleaned off, she was getting only a few popups, and now it won't even boot.
Click to expand...

Well actually you had a bunch of malware remaining. Some pretty nasty. All of the below was bad.

C:\Program Files\TopSearch\TopSearch.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll
O2 - BHO: (no name) - {CB88BA82-A452-E790-8C87-9C63C03C0EE6} - (no file)
O2 - BHO: (no name) - {E7EE1AAA-A4B9-9360-1C69-4075304EA1AA} - C:\WINDOWS\system32\cdmweb\shrydekalh.dll
O4 - HKLM\..\Run: [TopSearch] C:\Program Files\TopSearch\TopSearch.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\ywqqi.exe reg_run
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
Click to expand...

Do you have a WinXP SP2 boot CD for this PC? We may have to do a repair.

strider1722 · Nov 27, 2005

Yeah, they have one. It came with their other computer, but it says it's a recovery cd for HP or Compaq.

strider1722 · Nov 27, 2005

Do I choose to set up Windows or repair the Windows XP installation using recovery console?

chaslang · Nov 27, 2005

strider1722 said:

Yeah, they have one. It came with their other computer, but it says it's a recovery cd for HP or Compaq.
Click to expand...

That is not a bootable WinXP SP2 CD then. It is probably a CD from the PC manufacturer to put the PC back into the state it was shipped.

Are the PCs the same?

strider1722 · Nov 27, 2005

They are not the same, but it is setting up windows. I figure it's worth a try. It says Operating system Windows XP SP2 install on the disc, so I think that's what we're looking for.

strider1722 · Nov 27, 2005

Or... not setting up. Went to set up and it said it was formatting... then got stuck on 0% for about 10 minutes... trying it again.

strider1722 · Nov 27, 2005

Still nothing. Tried deleting the partitioned space and creating a new partition. Any ideas?

strider1722 · Nov 27, 2005

Ok reloading windows is working now. Should I go through the steps for removing the malware again once the installation finishes and hope it doesn't crash or what?

chaslang · Nov 27, 2005

strider1722 said:

Ok reloading windows is working now. Should I go through the steps for removing the malware again once the installation finishes and hope it doesn't crash or what?
Click to expand...

If you have partitioned and formatted and then reinstalled Windows, your malware issues should be gone. What you will need to do is get all of your updates for all software (especially Windows) and get all protection back in place ASAP. See the below link:

How to Protect yourself from malware!

Hopefully you did not mess up the ability to get your WinXP software validated as a legal copy.

strider1722 · Nov 27, 2005

I believe it worked out alright. Thanks for the help.

chaslang · Nov 27, 2005

You're welcome. Surf safely!

Log in or Sign up

Help removing CoolWWWSearch.Aboutblank and IE Plugin

strider1722 Private E-2

strider1722 Private E-2

Attached Files:

hijackthis11-26-05.txt

strider1722 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

strider1722 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

strider1722 Private E-2

strider1722 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

strider1722 Private E-2

strider1722 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

strider1722 Private E-2

strider1722 Private E-2

strider1722 Private E-2

strider1722 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

strider1722 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member