"http://rl.webtracer.cc" start page, unable to remove

cosmic pawn · Mar 29, 2005

Hey.

Need a bit of help getting rid of this nasty.
IE keeps loading up with "http://rl.webtracer.cc" as its start page, which in turn redirects to "http://all-ru.net/", several bookmarks have also been added to my favourites menu.

I have been struggling with this problem all afternoon, using methods outlined in the "READ ME FIRST BEFORE ASKING FOR SUPPORT" thread, plus some others. The closest I came to success was using HJT to fix some "RO" and "O19" entries, and manually deleting the "stsheets.dat" file. Upon reboot everything appeared to be fixed, however a second reboot revealed I was right back where I started.

Immediately prior to this post I have gone through the methods outlined in the "READ ME FIRST BEFORE ASKING FOR SUPPORT" (for about the gajillionth time today!), specifically;

From safe mode:
--Trend micro online scan - nothing detected.
--Symantec online security scan - all safe, except "anti virus product check", I'm guessing as my AV software did'nt load in safe mode.
--Avert stinger - nothing detected.
--Ccleaner.
--Adaware se - full system scan, 6 critical object detected and cleaned, "possible browser hijack attempts" relating to bookmarks.
--Spybot - 7 "coolwwsearch" relating to bookmarks, and 5 "possible hijacker" relating to registry entries, all cleaned.
--About buster - nothing detected.
--Cwshredder - nothing detected.
--Hsremove - 8 items removed.
--Kill2me - nothing detected.

Reboot to normal mode, with no success, problem is still there.
Have run a HJT scan at this point (after closing everything else) and the log is attached here.

It may also be worth noting that my resident AV, Mcafee virus scan, isnt detecting anything either (except for HJT - weirdness).

Hope someone can help me!

chaslang · Mar 29, 2005

Your OS and IE versions are way out of date. After we fix your current problems, you MUST get updated.

Please unzip and run the RegSrchTool
Please make sure that your Anti-Virus app does not have Script Blocking enabled. If so, disable it to allow the tool to run.

Please enter the following into the Search Box: stsheets

Please save the results of this search and attach them.

Then, please unzip and run the Locate.zip Tool
DoubleClick on the locate.bat to run it and attach that log.

Post the two logs as attachments!

cosmic pawn · Mar 30, 2005

Roger on getting updated.

Here are the logs.

chaslang · Mar 30, 2005

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixsts.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixsts.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

REGEDIT

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\vdmindvg]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\vdmindvg]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdmindvg]
[-HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Styles]
[-HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Styles]
[-HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Styles]
[-HKEY_USERS\S-1-5-21-57989841-926492609-725345543-1003\Software\Microsoft\Internet Explorer\Styles]
[-HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Styles]
Click to expand...

Now un HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rl.webtracer.cc/-/?bayzm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://rl.webtracer.cc/-/?bayzm
O19 - User stylesheet: C:\WINDOWS\stsheets.dat

After clicking Fix, exit HJT.

Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\stsheets.dat
C:\WINDOWS\SYSTEM32\DRIVERS\VDMINDVG.SYS

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again.

Now run Ccleaner (installed while running the READ ME FIRST).

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

cosmic pawn · Mar 31, 2005

Well things went from bad to worse this afternoon... my brother jumped on this maching before I got home from work today to do 'homework', and got a multitude of new infections =o\

I have run through the READ ME FIRST procedure to takcle the new problems, which appeared to work - at least it got me back to where I was - and have now run through your instructions above, and everything seems to be back in good order.
I cant find any visible sign on any malware presence! =)

Heres the new HJT log, so you can confirm that for me *knock wood* and I can get onto those updates.....

chaslang · Mar 31, 2005

That looks good. The only thing you should do is fix the two below lines:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm

They are remants of running HSremove (which you did not need to run). Set your home page to what your prefer.

Now complete ALL the steps in the below link. The step in that link is Windows update:

How to Protect yourself from malware!

If you do not want to go to Win XP SP2 right now, you should select Custom Install at Windows Update and do all the other Updates except SP2. If you do go to SP2, make sure you disable its built-in firewall after installing on of the ones recommended in the How to Protect link. The Windows XP SP2 firewall is enabled by default and it does not provide the level of protection that the third party ones offer.

cosmic pawn · Apr 1, 2005

Wonderful.

Thanks a heap mate, I appreciate the help!
If you're ever in Aust, I owe ya a case of beer

chaslang · Apr 1, 2005

cosmic pawn said:

Wonderful.

Thanks a heap mate, I appreciate the help!
If you're ever in Aust, I owe ya a case of beer
Click to expand...

You're welcome! I would love to visit Australia! But this is about as close as I will get! So tell me how's the weather?

Log in or Sign up

"http://rl.webtracer.cc" start page, unable to remove

cosmic pawn Private E-2

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

cosmic pawn Private E-2

Attached Files:

report.txt

sOutTmp171535.tmp.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

cosmic pawn Private E-2

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

cosmic pawn Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member