HSA (Only the Best) and systj32.exe

Some days ago ZoneAlarm started telling me, on XP Home, that "systj32.exe was trying to access the internet". This has happened quite a few times. There was also a separate alert which mentioned "glb3.tmp", but I saw this only once.
Since I don't know what systj32.exe is I have denied access.

"Only the Best" has appeared on my system too but I can't say whether this was coincidental with the the start of systj32.exe's attempts to access the net.

I have read "When all else fails - Generic Solution to HSA (Only the Best) & About:Blank hijack" and followed the instructions, as follows.

Bit Defender in normal mode (I can't connect to the net in Safe mode) says everything is clean.

First scan with RavAntivirus produced this:

Scan started at 18/09/2005 22:51:54

Scanning memory...
Scanning boot sectors...
Scanning files...
C:\Documents and Settings\David Bridgen\My Documents\Graphics\pixie.exe->(UPXW) - Win32/Gigex.A@mm -> Suspicious
C:\Program Files\Nattyware\Pixie\pixie.exe->(UPXW) - Win32/Gigex.A@mm -> Suspicious
C:\Program Files\WinRAR\Uninstall.exe - Backdoor:Win32/Poebot.E -> Suspicious

Scanned
============================
Objects: 141457
Directories: 8429
Archives: 4307
Size(Kb): -470849
Infected files: 0

Found
============================
Viruses found: 0
Suspicious files: 3
Disinfected files: 0
Mail files: 724


While that scan was being executed ZoneAlarm warned of "Dangerous Behaviour" "c:\windows\system32\systj32.exe (systj32.exe) event=2 subevent=2 class=2" ..... whatever that means. I denied it.


The "pixie" mentioned is the colour identifying application - apparently there are other appliations too.
I uninstalled it and then deleted the Nattyware folder. I forgot about the thing in WinRAR folder.

I then scanned with Bit Defender again. Clean.

And then with RavAntivrus again. The report was as follows:



Scan started at 19/09/2005 14:53:42

Scanning memory...
Scanning boot sectors...
Scanning files...
C:\Program Files\WinRAR\Uninstall.exe - Backdoor:Win32/Poebot.E -> Suspicious

Scanned
============================
Objects: 141267
Directories: 8382
Archives: 4302
Size(Kb): -532743
Infected files: 0

Found
============================
Viruses found: 0
Suspicious files: 1
Disinfected files: 0
Mail files: 725




I unsinstalled WinRAR and then deleted its folder with whatever else was left in it.

During this second RavAntvirus scan I had another alert from ZoneAlarm that systj32.exe was trying to gain access to the internet. I denied it.

I then ran Stinger. Clean.

And then CCleaner.

And then AdAware SE Plus (plus VX2).

The log for that run is as follows:




Ad-Aware SE Build 1.06r1
Logfile Created on:19 September 2005 21:29:19
Using definitions file:SE1R66 14.09.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
CoolWebSearch(TAC index:10):25 total references
MRU List(TAC index:0):2 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Search for low-risk threats
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Ignore spanned files when scanning cab archives
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Block pop-ups aggressively
Set : Automatically select problematic objects in results lists
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Show splash screen
Set : Backup current definitions file before updating
Set : Play sound at scan completion if scan locates critical objects


19-09-2005 21:29:19 - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : C:\Documents and Settings\David Bridgen\recent
Description : list of recently opened documents


MRU List Object Recognized!
Location: : S-1-5-21-1123561945-1957994488-1060284298-1004\software\microsoft\windows media\wmsdk\general
Description : windows media sdk


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 348
ThreadCreationTime : 19-09-2005 10:25:40
BasePriority : Normal


#:2 [csrss.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 408
ThreadCreationTime : 19-09-2005 10:25:47
BasePriority : Normal


#:3 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ProcessID : 432
ThreadCreationTime : 19-09-2005 10:25:48
BasePriority : High


#:4 [services.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 476
ThreadCreationTime : 19-09-2005 10:25:49
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Services and Controller app
InternalName : services.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : services.exe

#:5 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 488
ThreadCreationTime : 19-09-2005 10:25:50
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe

#:6 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 632
ThreadCreationTime : 19-09-2005 10:25:52
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:7 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 692
ThreadCreationTime : 19-09-2005 10:25:52
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:8 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 748
ThreadCreationTime : 19-09-2005 10:25:53
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:9 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 816
ThreadCreationTime : 19-09-2005 10:25:54
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:10 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 840
ThreadCreationTime : 19-09-2005 10:25:54
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:11 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1132
ThreadCreationTime : 19-09-2005 10:26:03
BasePriority : Normal
FileVersion : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)
ProductVersion : 5.1.2600.2696
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : spoolsv.exe

#:12 [d3wt.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 1296
ThreadCreationTime : 19-09-2005 10:26:07
BasePriority : Normal


#:13 [avgamsvr.exe]
FilePath : C:\PROGRA~1\Grisoft\AVGFRE~1\
ProcessID : 1316
ThreadCreationTime : 19-09-2005 10:26:09
BasePriority : Normal
FileVersion : 7,1,0,321
ProductVersion : 7.1.0.321
ProductName : AVG Anti-Virus System
CompanyName : GRISOFT, s.r.o.
FileDescription : AVG Alert Manager
InternalName : avgamsvr
LegalCopyright : Copyright © 2005, GRISOFT, s.r.o.
OriginalFilename : avgamsvr.EXE

#:14 [avgupsvc.exe]
FilePath : C:\PROGRA~1\Grisoft\AVGFRE~1\
ProcessID : 1368
ThreadCreationTime : 19-09-2005 10:26:11
BasePriority : Normal
FileVersion : 7,1,0,321
ProductVersion : 7.1.0.321
ProductName : AVG 7.0 Anti-Virus System
CompanyName : GRISOFT, s.r.o.
FileDescription : AVG Update Service
InternalName : avgupsvc
LegalCopyright : Copyright © 2005, GRISOFT, s.r.o.
OriginalFilename : avgupdsvc.EXE

#:15 [sagent2.exe]
FilePath : C:\Program Files\Common Files\EPSON\EBAPI\
ProcessID : 1424
ThreadCreationTime : 19-09-2005 10:26:13
BasePriority : Normal
FileVersion : 2, 2, 0, 0
ProductVersion : 1, 0, 0, 0
ProductName : EPSON Bidirectional Printer
CompanyName : SEIKO EPSON CORPORATION
FileDescription : EPSON Printer Status Agent
InternalName : SAgent2
LegalCopyright : Copyright (C) SEIKO EPSON CORP. 2000-2001
OriginalFilename : SAgent2.exe

#:16 [gcasserv.exe]
FilePath : C:\Program Files\Microsoft AntiSpyware\
ProcessID : 1500
ThreadCreationTime : 19-09-2005 10:26:14
BasePriority : Idle
FileVersion : 1.00.0615
ProductVersion : 1.00.0615
ProductName : Microsoft AntiSpyware (Beta 1)
CompanyName : Microsoft Corporation
FileDescription : Microsoft AntiSpyware Service
InternalName : gcasServ
LegalCopyright : Copyright © 2004-2005 Microsoft Corporation. All rights reserved.
LegalTrademarks : Microsoft® and Windows® are registered trademarks of Microsoft Corporation. SpyNet(tm) is a trademark of Microsoft Corporation.
OriginalFilename : gcasServ.exe

#:17 [tcpsvcs.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1504
ThreadCreationTime : 19-09-2005 10:26:14
BasePriority : Normal
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : TCP/IP Services Application
InternalName : TCPSVCS.EXE
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : TCPSVCS.EXE

#:18 [snmp.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 1548
ThreadCreationTime : 19-09-2005 10:26:16
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : SNMP Service
InternalName : snmp.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : snmp.exe

#:19 [gcasdtserv.exe]
FilePath : C:\Program Files\Microsoft AntiSpyware\
ProcessID : 1644
ThreadCreationTime : 19-09-2005 10:26:19
BasePriority : Normal
FileVersion : 1.00.0615
ProductVersion : 1.00.0615
ProductName : Microsoft AntiSpyware (Beta 1)
CompanyName : Microsoft Corporation
FileDescription : Microsoft AntiSpyware Data Service
InternalName : gcasDtServ
LegalCopyright : Copyright © 2004-2005 Microsoft Corporation. All rights reserved.
LegalTrademarks : Microsoft® and Windows® are registered trademarks of Microsoft Corporation. SpyNet(tm) is a trademark of Microsoft Corporation.
OriginalFilename : gcasDtServ.exe

#:20 [wrsssdk.exe]
FilePath : C:\Program Files\Webroot\Spy Sweeper\
ProcessID : 1648
ThreadCreationTime : 19-09-2005 10:26:19
BasePriority : Normal
FileVersion : 1,0,3,232
ProductVersion : 1, 0
ProductName : Spy Sweeper SDK
CompanyName : Webroot Software, Inc.
FileDescription : Spy Sweeper SDK
LegalCopyright : Copyright (C) 2002 - 2004, All Rights Reserved.
LegalTrademarks : Spy Sweeper is a trademark of Webroot Software, Inc.
OriginalFilename : SpySweeper.exe

#:21 [pupxpman.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 276
ThreadCreationTime : 19-09-2005 10:26:55
BasePriority : Normal
FileVersion : 1.04.0347
ProductVersion : 1.04.0347
ProductName : PwrUpManager
CompanyName : ashampoo GmbH & Co. KG
FileDescription : Ashampoo PowerUp XP
InternalName : pupxpman
LegalCopyright : ashampoo GmbH & Co. KG
OriginalFilename : pupxpman.exe

#:22 [jusched.exe]
FilePath : C:\Program Files\Java\jre1.5.0_04\bin\
ProcessID : 596
ThreadCreationTime : 19-09-2005 10:27:00
BasePriority : Normal


#:23 [ctfmon.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 924
ThreadCreationTime : 19-09-2005 10:27:07
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : CTF Loader
InternalName : CTFMON
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : CTFMON.EXE

#:24 [drst.exe]
FilePath : C:\Program Files\SpeedTouch\Dr SpeedTouch\
ProcessID : 1008
ThreadCreationTime : 19-09-2005 10:27:09
BasePriority : Normal


#:25 [wkcalrem.exe]
FilePath : C:\Program Files\MSWorks\Calendar\
ProcessID : 2304
ThreadCreationTime : 19-09-2005 10:28:28
BasePriority : Normal
FileVersion : 1,0,1,1921
ProductVersion : 1,0,1,1921
ProductName : Microsoft Works
CompanyName : Microsoft Corporation
FileDescription : Microsoft Works Calendar Advise/Reminder Server
InternalName : Advise Server
LegalCopyright : Copyright © 1998
OriginalFilename : WKCALREM.EXE

#:26 [sgmain.exe]
FilePath : C:\Program Files\SpywareGuard\
ProcessID : 2428
ThreadCreationTime : 19-09-2005 10:28:42
BasePriority : Normal
FileVersion : 2.02.0001
ProductVersion : 2.02.0001
ProductName : SpywareGuard
FileDescription : SpywareGuard
InternalName : sgmain
LegalCopyright : Copyright (C) 2002-2003 Javacool Software LLC
OriginalFilename : sgmain.exe
Comments : SpywareGuard

#:27 [sgbhp.exe]
FilePath : C:\Program Files\SpywareGuard\
ProcessID : 2512
ThreadCreationTime : 19-09-2005 10:29:20
BasePriority : Normal
FileVersion : 2.02.0001
ProductVersion : 2.02.0001
ProductName : SG Browser Hijacking Protection
FileDescription : SG Browser Hijacking Protection
InternalName : sgbhp
LegalCopyright : Copyright (C) 2002-2003 Javacool Software LLC.
OriginalFilename : sgbhp.exe
Comments : SG Browser Hijacking Protection

#:28 [mantispm.exe]
FilePath : C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\
ProcessID : 2840
ThreadCreationTime : 19-09-2005 10:30:26
BasePriority : Normal
FileVersion : 4, 7, 0, 5831
ProductVersion : 4, 7, 0, 5831
FileDescription : Spam Filter
InternalName : mantispm.exe
LegalCopyright : (c) 2002-2004
OriginalFilename : mantispm.exe

#:29 [alg.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 2920
ThreadCreationTime : 19-09-2005 10:30:34
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Application Layer Gateway Service
InternalName : ALG.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : ALG.exe

#:30 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ProcessID : 2184
ThreadCreationTime : 19-09-2005 10:48:50
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe

#:31 [iexplore.exe]
FilePath : C:\Program Files\Internet Explorer\
ProcessID : 2412
ThreadCreationTime : 19-09-2005 11:02:52
BasePriority : Normal
FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 6.00.2900.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Internet Explorer
InternalName : iexplore
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : IEXPLORE.EXE

#:32 [findfast.exe]
FilePath : C:\Program Files\Microsoft Office\Office\
ProcessID : 2912
ThreadCreationTime : 19-09-2005 17:31:34
BasePriority : Normal


#:33 [explorer.exe]
FilePath : C:\WINDOWS\
ProcessID : 4644
ThreadCreationTime : 19-09-2005 17:41:24
BasePriority : Normal
FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 6.00.2900.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : EXPLORER.EXE

#:34 [wscntfy.exe]
FilePath : C:\WINDOWS\system32\
ProcessID : 6140
ThreadCreationTime : 19-09-2005 20:21:00
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Security Center Notification App
InternalName : wscntfy.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : wscntfy.exe

#:35 [ad-aware.exe]
FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Plus\
ProcessID : 4584
ThreadCreationTime : 19-09-2005 20:28:39
BasePriority : Normal
FileVersion : 6.2.0.237
ProductVersion : SE 106
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft AB Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 2


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

CoolWebSearch Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{676575dd-4d46-911d-8037-9b10d6ee8bb5}

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 1
Objects found so far: 3


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 3


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 3



Deep scanning and examining files (C
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 3


Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

CoolWebSearch Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\urlsearchhooks

CoolWebSearch Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\hsa

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\hsa
Value : UninstallString

CoolWebSearch Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\se

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\se
Value : UninstallString

CoolWebSearch Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\sw

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\windows\currentversion\uninstall\sw
Value : UninstallString

CoolWebSearch Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : system\currentcontrolset\services\ 11fßä#·ºÄÖ`i

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : system\currentcontrolset\services\ 11fßä#·ºÄÖ`i
Value : Start

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : system\currentcontrolset\services\ 11fßä#·ºÄÖ`i
Value : ErrorControl

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : system\currentcontrolset\services\ 11fßä#·ºÄÖ`i
Value : ImagePath

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : system\currentcontrolset\services\ 11fßä#·ºÄÖ`i
Value : DisplayName

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : system\currentcontrolset\services\ 11fßä#·ºÄÖ`i
Value : ObjectName

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : system\currentcontrolset\services\ 11fßä#·ºÄÖ`i
Value : FailureActions

CoolWebSearch Object Recognized!
Type : Regkey
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\downloadmanager

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\microsoft\internet explorer\main
Value : Enable Browser Extensions

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\microsoft\internet explorer\new windows
Value : PopupMgr

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\microsoft\internet explorer\main
Value : Search Page

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft
Value : set

CoolWebSearch Object Recognized!
Type : RegValue
Data :
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\main
Value : Search Bar

CoolWebSearch Object Recognized!
Type : RegData
Data : no
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\microsoft\internet explorer\main
Value : Use Search Asst
Data : no

CoolWebSearch Object Recognized!
Type : RegData
Data : about:blank
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\microsoft\internet explorer\main
Value : Start Page
Data : about:blank

CoolWebSearch Object Recognized!
Type : RegData
Data : no
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\main
Value : Use Search Asst
Data : no

CoolWebSearch Object Recognized!
Type : RegData
Data : about:blank
TAC Rating : 10
Category : Malware
Comment :
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\main
Value : Start Page
Data : about:blank

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 24
Objects found so far: 27

21:57:44 Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:28:24.691
Objects scanned:238597
Objects identified:25
Objects ignored:0
New critical objects:25




I then ran the other programs mentioned in the "How to".


So, I'm still stuck with "Only the Best".

I have read "When all else fails - Generic Solution to HSA (Only the Best) & About:Blank hijack" but it's above my head.

As you say " ... HicackThis ... is for advanced users, so if you do not understand how to use it, you do not need it...."

Can someone help please?

And what is systj32.exe ? Good. Bad. If the latter, how do I get rid of it?

 

Regarding step 2 .....

Workstation NetLogon Service is present.
Right clicking produces a notice:

Services.
Configuration Manager: A required entry in the register is missing or an attempt to write to the registry failed.

Then, after clicking on OK:

Services.
The system cannot find the file specified.



about:Buster .....

Pressing Update produces "Run-time error '5': Invalid procedure call or argument".
I have deleted all three files and re-downloaded from all the download sites you list - the author's doesn't work - but I still get the same results.


HSremove runs ok. Nothing found.


A new (today) problem is AVG Resident Shield telling me that a virus has been detected:

"windows\system32\vwlsl.dll
Trojan horse Startpage. 19A0"

I click the "Heal" button, the program heals it but it reappears.



The HijackThis file is attached.

 

Thank you Chas for your last two posts in this thread.

Regarding the penultimate one.
Okay, about:Buster is now in its own folder.
Yes, HSremove did report "8 items removed" when run again. I think I misread the results the first time.
Spybot's TeaTimer is now disabled.
No, I didn't edit the HJT log. I wouldn't be so presumptuous. And yes, I am sure that Bit Defender and RavAntivirus ran completely. I haven't seleted any HJT filtering.

Regarding your last post.
Sorry, I'm using XP Home and system Restore is disabled and viewing of hidden files is enabled.

I did another scan according to the READ ME FIRST tutorial but in normal mode again since I can't connect to the Internet in safe mode.

Bit Defender, no problems found.

RAVAntivirus. No viruses.

Stinger. Clean.

Disconnected from Internet.

CCleaner run.

AdAware run. Nasty items deleted.

VX2 run. System clean.

Spybot run. 6 problems fixed.

CWshredder run. CoolWeb not found.

Kill2me run. ..... after which My Documents was opened. Why?

about:Buster run after downloading the missing 'comctl32.ocx' file. No ads found. No files found.
But note that I couldn't update beforehand. I was advised that "An error has occurred while updating."

HSremove run.
Six processes "Done", and the phantom "8 items removed." Removal complete.

Then I ran HJT again.
I couldn't see two of the O4 entries referred to in your post.

Then rebooted in safe mode.

I couldn't see c:\windows\iepm.dll, c:\windows\ipny.exe, or c:\windows\system32\sysbm.exe.

I had previously deleted c:\windows\system32\systj32.exe after you said that it was part of the HSA hijacker.

I then ran CCleaner again, deleted the prefetch files, reset the web settings and rebooted normally.

The subsequent HJT log is attached.

Thank you for your perseverance Chas.

 

Sorry Chas, I did reboot after posting the last HJT log so I guess that negates what you said in the last post.

Okay, what shall I do now?

 

Sorry about the hiccup last night. AVG was running and had responded in the afirmative when asked if I wanted to re-start after it eliminated something. AVG is disabled for the time being.

I went throught the whole procedure again.

System restore is still off.
Everything has been done in normal mode, not safe.

BitDefender - no problems found.
RavAntivirus - no viruses found.

Disconnected from Internet.

CCleaner.
AdAware - 22 objects removed - have log saved.
VX2 - system clean.
Spybot - CoolWWWSearch.HomeSearch 1 entry
CoolWWWSearch.SearchKlick 2 entries
Shop At Home 1 entry
Trek Blue Error Nuker 4 entries

Removed all.

CWShredder.
Kill2Me. - after which "My Documents" was opened.
aboutBuster - "Run-time error '5' "
HSRemove = 8 items removed.

 

I had reset IE home page to Major Geeks, more than once, but it was reset.
the AntiVirus Personal program has been uninstalled.
My browser is IE6.
VB runtime files downloaded and installed. aboutBuster still coughs up the "runtime error '5' " message.

The three registry entries were copied and entered into the registry. Note, the system didn't say "merge", it said "add", which I did.

System restore is still off.

HJT. The two processes were killed.
Looked for those eight lines but the first two weren't listed. Selected the other six. Exited IE browser and then Fixed them.

Rebooted safe mode.
First two items, javafr.dll and jpzx.exe, not found. Deleted winil32.exe.

CCleaner run.

Web settings reset, again.

Reboot normal. HJT log attached.

 

Addendum to last post.

For the first 5 minutes or so after the last reboot, I couldn't do anything on the toolbar/quicklaunch/system tray area - nothing would respond to the mouse.
SpywareGuard advise of IE current search page being changed from <none> to res://c:\windows\vyire.dll/sp.html#1001 and gave me the option of Resorting old value or keeping new. I chose restore.
Same/similar thing with IE search bar, IE search page, IE default page, search bar and default search. I selected restore for each.

 

HJT.

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\uyire.dll/sp.html#10001

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\uyire.dll/sp.html#10001

Both selected. Exit IE broswer. Fixed both. (SpywareGuard didn't respond.)

TrojanHunter installed and updated, full scan on C. Cropped screen dump saved and attached.
Note my mis-spelling of aboutBuster. Could that be the reason for its non-function?

CCleaner run.

Ewido installed and updated. Disconnected from 'phone line. Rebooted in safe mode. Every file/complete system scan. Report atached.

Rebooted normal. System very slow, at least at first. Closed, via Task Manager, initial IE attempt to connect (wasn't responding.) Quick launch etc wouldn't respond to mouse for first couple of minutes.

IE default page still MajorGeeks.

 

Sorry, here it is.

I commented on the system at the end of the post.

 

Hi Chas.

The problem with mouse access to the quick launch and system tray seems to have gone.
I did notice after this reboot that there was a lot of disc activity, the yellow l.e.d. on the PC being permanently lit for a while, after all the icons had appeared in the system tray.
During this time a clock I have on the desktop halted its seconds increments for about 5 to 10 seconds at a time and then jumped forward.
Task Manager shows the great majority of this activity is due to System Idle Process, CPU Usage up around 75 to 80%.
This settles down to 3% minimum but shoots up to 90 to 100% every 10 seconds.
I have no idea if this is useful information or not.

The HJT log is attached.

Thank you for all the time and effort which you are putting into this. I really appreciate it.

 

No Chas, I have no idea what that line, O9 - Extra button, is.

Once again thank you for your time and effort.

 

Hi Chas.

No, I didn't install it. Don't even know what "webzone" is. I'll do a search for it and see what that turns up.

Oh, by the way, I tried Firefox some time ago but ditched it. I've re-installed it and using it now.

 

No, it's part of "Enough is Enough"

See https://netfiles.uiuc.edu/ehowes/www/resource6.htm