Not sure if this is a trojan or a bad setting somewhere???

s2foster · Sep 8, 2006

I am at the limit of my technical knowledge here so hopefully, this is the right place to raise the question and I can articulate it clearly:

I had set up my default IE search engine to be Google. I also set it so that if I typed a search term in the address bar, it used google as the search engine and returned results in the window below.

For the last couple of days, wheneven I used a search term it would reroute the search to something that in the address bar was labeled ww9.seek-aid.net. I noticed an opt-out hyperlink at the screen bottom, turned it 'off' (it uses a cookie) and it forced the default to msn.com's search. I also deleted all regedit keys I found containing seek-aid.net. (There was only one and it may have been just a history item.)

I went into the registry and made sure that every instance of ie.search.msn.com was replaced with the appropriate google references and set up all of the default search registry entries to google according to instructions found on google. Now, the seach toolbar button on IE defaults to google, but the address bar search still goes to MSN- and back to seek-aid if I delete that cookie.

I ran SpyCatcher, AdAware, SpyBot S&D, CleanCache, CCleaner, OneCare Live, BFU, etc. I followed the major geeks removal instructions through deleting the prefetch files and even tried the surfsidekick removal procedure in its entirety. I also removed Morpheus. I currently use a fully up to date copy of McAfee Security Suite Antivirus and Personal Firewall.

No luck. I ran HijackThis! both before and after. The logs are attached. I tried to upload the system info file, but it was too large.

Obviously, this trojan (if it is one!) or whatever it is is still hijacking my browser. But I am at a total loss of how to find it or what to do to get rid of it.

I tried google-ing 'seek-aid' (and several variants) and searching it on MajorGeeks and a few other support forums and found nothing.

PLEASE HELP or at least point me in the right direction!

Thanks...

DavidGP · Sep 8, 2006

Hi and Welcome to Majorgeeks!

The below guide is laid out in a way as to not miss any malware thats on your PC, each step is crucial to be run in the order specified, once you have completed the guide and attached the requested logs then the malware guys here will tailor some specific to your PC, instructions to remove any remaining malware, the guys are superb at making their instructions as easy to follow as possible.. so good luck

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

[*]runkeys.txt - the log from GetRunKey.bat
[*]newfiles.txt - the log from ShowNew.bat

CounterSpy - ONLY IF you were not able to run Windows Defender

Bitdefender - from step 6

Panda Scan - from step 6

HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

Log in or Sign up

Not sure if this is a trojan or a bad setting somewhere???

s2foster Private E-2

Attached Files:

hijackthisrefBEFORE.log.txt

hijackthisrefAFTER.log

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member