hijack log - please help

Hi

I've got problems with a hijacker that I just can't get rid of.

I've followed the sticky thread to the letter, although with the proviso I couldn't do anything in safe mofde with networking as my usb modem isn't recognised in that., so I couldn't get online.

Windows XP Service Pack 1 (doh!)
Spybot identified the culprit as coolwwwsearch.winproc32

Online Trend scan found
3x TROJ MEMTEST.A Non cleanable
system32\ionived.exe
system32\paripsetr.exe
ssytem32\parinipsidn.exe

TROJ DLOADER.W Can not access
s2_rttrs.dll
sockapitkc.dll
s2_etmsatkc.dll
all three could not be deleted due to being in use

TROJ MEMTEST.A non cleanable
thk3rtuspm.exe

TROJ STARTPAGE.FX non cleanable
c:\\dsQwCXZv.exe

Trend deleted except for the 'can not access' one

Hijack this log attached.

CWShredder never spots it as a coolwwwsearch when it scans.

Any suggestions?


Log: (Can't get attach to work!

Logfile of HijackThis v1.99.0
Scan saved at 11:12:03, on 12/01/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Hi Mark,

Before we start, I should note that I do not like the looks of this one: O4 - HKLM\..\Run: [FGLite] C:\PROGRA~1\WINABI~1\FOLDER~1\FGLITE.EXE /CL
It seems like the type of thing that may come with malware attached. Do you know it to be safe?



Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files is Enabled as per the tutorial.

Now, look in Task Manager (Ctrl-Alt-Del) for the following running process and, if you see it, try to END it:

xpsp2fw.exe

Now scan with HijackThis and Check the Boxes for the following:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://realsearch.cc/?a=2
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://realsearch.cc/?a=2
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://realsearch.cc/?a=2
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://realsearch.cc/?a=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://realsearch.cc/?a=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://realsearch.cc/?a=2
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://realsearch.cc/?a=2
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://realsearch.cc/?a=2
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://realsearch.cc/?a=2
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://realsearch.cc/?a=2

O4 - HKLM\..\Run: [XPSP2 Firewall] C:\WINDOWS\system32\xpsp2fw.exe

O4 - HKCU\..\Run: [Windows Update Client ] C:\WINDOWS\system32\wuclient.exe

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files Enabled and navigate to and DELETE the following if they should remain:

C:\WINDOWS\system32\xpsp2fw.exe

C:\WINDOWS\system32\wuclient.exe

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

Reboot to Normal Windows and Scan with HijackThis and try again to attach that log using the "Manage Attachments" tool when you post.

Let me know of any problems you may have encountered with the above instructions and how your computer is running now. I will try to check back when time permits.

Best luck
PP

 

Hi

This appears to have sorted the problem. The FGLITE wasn't the source, as I've been using that for a while now. Surfing disreputable sites was the cause :-(

I'm going to amend my surfing ways, and download Service Pack 2!

Ta v much - most appreciated!

 

Hey Mark,

This entry still remains:

O4 - HKCU\..\Run: [Windows Update Client ] C:\WINDOWS\system32\wuclient.exe

You should fix with HJT and doublecheck to make sure the wuclient.exe has been deleted.

Other than that, looks OK.

PP