Superwebsearch

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Sharon, Oct 7, 2004.

Page 1 of 2
  1. Sharon

    Sharon Private E-2

    Hello,
    I just joined tonight. And have followed all the steps posted at http://forums.majorgeeks.com/showthread.php?t=35407
    I had to use IE6 yesterday (and today at Bitdefender-it couldn’t finish scanning because IE6 shutdown) and seem to have superwebsearch on my computer. Ad-Aware SE and Spybot didn't find anything. But when I ran Hijack This yesterday, it found:

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.superwebsearch.com/ie/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.superwebsearch.com/ie/

    I had it clean the two entries. When I ran Spysweeper it found: Ezula iLookup, version 2.0 Adware: WildMedia, version 1. I had it clean everything. When I rebooted Spyware Blaster popped up with this:

    BROWSER HIJACK ALERT - BROWSER PAGE CHANGED
    On 13:05:22 10/06/2004 a browser page change was detected.
    Registry Location: HKCU\Software\Microsoft\Internet Explorer\Main\
    Value Name: Search Bar
    Old Value: <none>
    New Value: http://www.superwebsearch.com/ie/
    User Action Taken: RESTORE OLD VALUE

    I don't know how to clean this up. In all the searching I've done, there isn't one file relating to any of the spyware found on my machine. So, my question is why is superwebsearch still trying to change my home page? I've also run CWShredder and mini removal coolwebsearch smartkiller, nothing has been found. This is the latest HJT log:
    I question this entry C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS What is it? I haven't downloaded anything from Lanovation.

    Logfile of HijackThis v1.97.7
    Scan saved at 5:42:22 PM, on 10/7/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)


    Thank you,
    Sharon

    LOG DELETED BY chaslang: please follow forum rules on HJT posting and get the current HJT version.
     
    Last edited by a moderator: Oct 7, 2004
    Sharon, Oct 7, 2004
    #1
  2. Sharon

    Sharon Private E-2

    I apologize for posting the HJT log before being asked.
    Sharon
     
    Sharon, Oct 7, 2004
    #2
  3. PhilliePhan

    PhilliePhan Guest

    Hi Sharon,

    Your HijackThis is out of date. Download an up-to-date version and EXTRACT it from the ZIP file to its own, safe folder - C:\Program Files\HijackThis
    Logs should be saved as .txt files and posted as attachments via the "Attachment Manager" tool.

    Did you look in Add or Remove Programs for suspicious looking entries?
    Were you in Safe Mode with System Restore off when you ran through the tutorial?

    Take a look in your Downloaded Program Files folder or run a search of your computer for the following and remove them if found:
    i-lookup.com
    globalwebsearch.com
    superwebsearch.com
    traffichog.com
    searchbus.com
    globaltoolbar.com

    More info:
    http://www.doxdesk.com/parasite/ILookup.html

    Regarding C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS, I can't find anything good about it. I think it has something to do with remote access to your computer. Gateway, maybe? I believe it may be legitimate – Chaslang, our resident genius, will know better than I.

    Sorry I couldn't be of more assistance. Let us know if you find ILookup or anything like it.

    Hang in there :)

    PP
     
    PhilliePhan, Oct 7, 2004
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    As I said in another recent thread with Lyndsey:

    Did you or a system administrator load this PRISMXL.SYS stuff?
    C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS

    It is sometimes loaded with Gateway PCs or your network administrator is using
    Prism Deploy to manage the software configuration of your PC
     
    chaslang, Oct 7, 2004
    #4
  5. PhilliePhan

    PhilliePhan Guest

    That must have been what got stuck in my tiny brain! ;) I knew I had seen it before!

    PP
     
    PhilliePhan, Oct 8, 2004
    #5
  6. Sharon

    Sharon Private E-2

    PP & Chaslang,
    Thank you for the help. Attached is the new log of HJT. Yes, I ran everything in safte mode I searched for the files you listed and nothing was found. Nothing was found in Add or Remove Programs. Followed everything at http://www.doxdesk.com/parasite/ILookup.html and everything came up negative. I didn't download any PRISMXL.SYS stufff. I'm thinking it has to be something that gets loaded into this computer with one of the gateway disks. I reformatted this computer two weeks ago. This is the information found when I clicked on properties for PRISMXL:
    size: 64.0 KB (65,536 bytes)
    Created: Wednesday, September 08, 2004, 3:52:06 PM
    Modified: Wednesday, September 08, 2004, 3:52:06 PM
    If it helps, this is some of what can be viewed when I open the file:
    TLOSS error
    SING error
    DOMAIN error
    R6028
    - unable to initialize heap
    R6027
    - not enough space for lowio initialization
    R6026
    - not enough space for stdio initialization
    R6025
    - pure virtual function call
    R6024
    - not enough space for _onexit/atexit table
    R6019
    - unable to open console device
    R6018
    - unexpected heap error
    R6017
    - unexpected multithread lock error
    R6016
    - not enough space for thread data

    This application has requested the Runtime to terminate it in an unusual way.
    Please contact the application's support team for more information.
    R6009
    - not enough space for environment
    R6008
    - not enough space for arguments
    R6002
    - floating point not loaded
    Microsoft Visual C++ Runtime Library

    Runtime Error!
    Yesterday after I ran HSremove, spywareGuard popped up with the message my search page was being changed to the HSremove page.
    Today the same problem except it was being changed to google. Spy Sweeper gave me the same message. About:Buster didn't find anything. I'm at a loss. There's obviously something hiding in this computer.
    Sharon
     

    Attached Files:

    Sharon, Oct 8, 2004
    #6
  7. Kodo

    Kodo SNATCHSQUATCH

    PRISMXL is part of the Lanovation PRISM software. It's ok so far as I can tell.


    Download this application. (requires free registration) http://www.majorgeeks.com/download172.html
    a-squared (a²) Personal Edition 1.1


    Reboot your machine into safe mode. Find this file on your PC and remove it

    E:\content\include\XPPatchInstaller.CAB

    Then run the A-squared program I asked you to download.
    While still in safe mode, make a new HJT log.

    Then reboot to normal mode and get ANOTHER HJT log and post them BOTH so we can compare.
     
    Kodo, Oct 8, 2004
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Since neither HSremove or About:Buster know what everyone wants their home page to be, they default to changing it to HSremove.com and google.com respectively. That is not a problem. SpywareGuard is just detecting this and telling you.

    As Kodo indicates, fix the O16 line:

    O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://E:\content\include\XPPatchInstaller.CAB

    other than that I see nothing else wrong. You did not need to run HSremove or About:Buster since you did not have the related hijacker and still do not.

    Are you still having any problems?
     
    chaslang, Oct 8, 2004
    #8
  9. Sharon

    Sharon Private E-2

    Kodo,
    I did everything as you said. I could not manually find E:\content\include\XPPatchInstaller.CAB so I had HJT fix it. Ran a-2, it didn't find anything. When I rebooted, Spyware Guard gave another warning that my search page was being reset to www.superwebsearch.com
    Sharon
     

    Attached Files:

    Sharon, Oct 8, 2004
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Where did this come from all of a sudden:
    C:\Program Files\AntiSpy Pro\AntiSpyPro.exe

    It was not in your very first log. I don't have much info on whether this is a good application or not but two points:
    1) It's a bad idea to add programs to you computer when in the middle of debugging on forums like this unless the person helping you requests it.

    2) It bothers me the the program shows up in the running processes but I see no line that actually appears to load it. This is a typical symptom of some form of malware.

    If you did not install this, please tell us.

    Final comment: you never completed all the steps requested in http://forums.majorgeeks.com/showthread.php?t=35407

    I see no signs of the recommended online scans being run. You said you ran all the steps!
     
    chaslang, Oct 8, 2004
    #10
  11. Sharon

    Sharon Private E-2


    Chaslang,
    I stated in my first post "I had to use IE6 yesterday (and today at Bitdefender-it couldn’t finish scanning because IE6 shutdown)" I don't know why it isn't showing, AvxScan Online is installed on my computer. I am running Sun Java. My settings were already set as suggested http://forums.majorgeeks.com/showthread.php?t=35407 , they have been since I got this computer. Until you mentioned Antispy Pro, I didn't realize it was on my computer. No, I did not download it. I'll certainly be looking for it and removing it. I am running Trend Micro Internet Security.
    Sharon
     
    Sharon, Oct 8, 2004
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Bitdefender does show in your log. What I am questioning is why the TrendMicro and Symantec scans do not. It means you did not run them. If you have problems running steps, you need to tell us. It could be valueable info. Also, just in case you could not run the onlines scans in safe mode we specifically indicate for them to be run in normal mode (I don't know if that was your problem all you said was Bitdefender would not finish.)

    Now this Antispy Pro thing really bothers me. You did not install it and it was not in your earlier logs. So something put it there before your last HJT scan. Boot in safe mode and see if you can find C:\Program Files\AntiSpy Pro\AntiSpyPro.exe and delete it.

    Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Tell SpywareGuard to allow this change (I want to see it show up in your HJT log later.) Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

    Then post a new HJT log either way and tell me if you still have problems with your home page being hijacked.
     
    chaslang, Oct 8, 2004
    #12
  13. Sharon

    Sharon Private E-2

    Chaslang,
    I should have clarified, I was at Bitdefender in normal mode. I have cable internet and cannot connect in safe mode. I'm baffled as to why Trend didn't show up. I run it every other day. I just came from Bitdefender, it completed the scan and didn't find anything. IE6 had an error and shut down the first time at Bitdefender. I will post the results of your suggestions in the morning.
    I do appreciate the help.
    Thank you,
    Sharon
     
    Sharon, Oct 8, 2004
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Sharon,

    The Symantec and TrendMicro online scans are specific addresses that you need to go to run them. It is not the same as the TrendMicro software that you have installed on your PC. That is why it does not show in the O16 section. If you click those links in the Read Me (in normal mode if necessary), you will see what I mean.

    Let's not worry about those scans right. Just work on doing the stuff gave you in message #12
     
    chaslang, Oct 8, 2004
    #14
  15. Sharon

    Sharon Private E-2

    Chaslang,
    Attached is the HJT log. SypwareGuard and Spysweeper warned of the homepage being changed from www.superwebsearch to www.majorgeeks.
    I'm sorry, I thought the scans were the same. I'll go right now.
    Sharon
     

    Attached Files:

    Sharon, Oct 9, 2004
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Hi Sharon,

    Okay! Your log looks good. And majorgeeks.com is now your home page as I wanted to see it changed to. Is everything working okay? Any problems with superwebsearch.com?

    I don't expect that doing those online scans will show anything right now since we have already performed a bunch of house cleaning but it wouldn't hurt to run them.
     
    chaslang, Oct 9, 2004
    #16
  17. Sharon

    Sharon Private E-2

    Chaslang,
    My computer seems to be getting slower and superwebsearch wanted to change the pages again. Could something be hiding in registry or maybe changing the name of the files? What ever it is, it doesn't want to give up. I really hope I'm not going to have to reformat this computer to get rid of this stuff.
    I did perform the online scans. Trend says my computer is clean. This is what RAV said:
    C:\Program Files\Common Files\Webroot Shared\Internet.dll - Backdoor:Win32/Ferat.1_0 -> Suspicious
    C:\Program Files\WinRAR\Default.SFX - PWS:Win32/Banker -> Infected
    How could Bitdefender and Trend find my computer clean and RAV found something?
    Sharon
     
    Sharon, Oct 9, 2004
    #17
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    What items from Webroot are you running? What versions? I have only Spy Sweeper and I do not have a Webroot Shared folder. You could try located that Internet.dll and right click on it to get some Properties info from the Version tab. This could be a false positive. Not sure though.

    WinRAR does have a Default.sfx file in its directory. So that could also be a false positive.

    What about the Symantec online scan? Run it.

    Also go here and download Registrar lite and install it: http://www.majorgeeks.com/download469.html

    You need to use the search function built into Registrar Lite and let it look for matches to superwebsearch. But before doing that make sure when Registrar Lite first opens that you click in the left window to put the cursor on the top of the registry where the two little computer appear next to the word Registry. Then click on the magnifiying glass for search and enter the superwebsearch string and hit enter. Tell me what matches you get if any. Also look for matches to Abroad Software and www.abroadsoftware.com

    Also do the below:

    Open a DOS command prompt window (Start->Run, and in the open box enter "cmd" without the quotes and click ok.
    In the command prompt window enter the following commands each followed by a return (tell me the results for each):
    cd c:\windows\system32
    regsvr32 /u Ineb.dll
    regsvr32 /u GWS.dll
    regsvr32 /u Chgrgs.dll
    regsvr32 /u abeb.dll
    regsvr32 /u bmeb.dll
    regsvr32 /u sbus.dll
    regsvr32 /u drbr.dll
    then enter
    attrib -s -r -h Ineb.dll
    del Ineb.dll
    attrib -s -r -h GWS.dll
    del GWS.dll
    attrib -s -r -h Chgrgs.dll
    del Chgrgs.dll

    attrib -s -r -h abeb.dll
    del abeb.dll
    attrib -s -r -h bmeb.dll
    del bmeb.dll
    attrib -s -r -h sbus.dll
    del sbus.dll

    attrib -s -r -h drbr.dll
    del drbr.dll

    Please post a new HJT log.
     
    chaslang, Oct 9, 2004
    #18
  19. Sharon

    Sharon Private E-2

    Chaslang,
    There wasn't a version tab when I clicked on properties.
    Type of file: Application Extension
    Opens with: Unknown application

    Location: C:\Program Files\Common Files\Webroot Shared
    Size: 31.0 KB (31,744 bytes)
    Size on disk: 32.0 KB (32,768 bytes)

    Created: Thursday, September 09, 2004, 7:22:33 AM

    Modifies: Monday, May 17, 2004, 5:05:18 AM

    Accessed: Today, October 09, 2004, 3:39:36 PM

    Symantec Online Scan results:
    78579 files scanned, 0 file(s) infected on your disk drives.


    No viruses were detected in memory.


    I'm running Spy Sweeper Program Version 3.0.0 (Build 113) Using Spyware Definitions 403
    and Window Washer 5.5 (Build 5.5.1.19)

    Oh my gosh, you won't believe what's in this registry, it's not good! Here's and example:

    HKEY_USERS\S-1-5-21-789336058-492894223-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\startsurfing.com
    HKEY_USERS\S-1-5-21-789336058-492894223-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\steamycock.com
    HKEY_USERS\S-1-5-21-789336058-492894223-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\sterva.com
    this stuff starts at 008i.com-zyban-zocor-levitra.com.
    There's too much to list. How in the world did this garbage get in here? I've never heard of any these sites. I'm going to start searching about them.

    Registar Lite found for superwebsearch HKEY_USERS\S1-5-21-789336058-492894223-7253455...
    There are two entries for it.
    It didn't find anything for www.abroadsoftware.com.
    regsvr32 /u Ineb.dll -The specified module could not be found

    regsvr32 /u GWS.dll -The specified module could not be found

    regsvr32 /u Chgrgs.dll -The specified module could not be found

    regsvr32 /u abeb.dll -The specified module could not be found

    regsvr32 /u bmeb.dll -The specified module could not be found

    regsvr32 /u sbus.dll -The specified module could not be found

    regsvr32 /u drbr.dll -The specified module could not be found

    attrib -s -r -h Ineb.dll File not found - Ineb.dll
    del Ineb.dll Could Not Find C:\WINDOWS\system32\Ineb.dll

    attrib -s -r -h GWS.dll File not found - GWS.dll
    del GWS.dll Could Not Find C:\WINDOWS\system32\GWS.dll

    attrib -s -r -h Chgrgs.dll File not found - Chgrgs.dll
    del Chgrgs.dll Could Not Find C:\WINDOWS\system32\Chgrgs.dll

    attrib -s -r -h abeb.dll File not found - abeb.dll
    del abeb.dll Could Not Find C:\WINDOWS\system32\abeb.dll

    attrib -s -r -h bmeb.dll File not found - bmeb.dll
    del bmeb.dll Could Not Find C:\WINDOWS\system32\bmeb.dll

    attrib -s -r -h sbus.dll File not found - sbus.dll
    del sbus.dll Could Not Find C:\WINDOWS\system32\sbus.dll

    attrib -s -r -h drbr.dll File not found - drbr.dll
    del drbr.dll Could Not Find C:\WINDOWS\system32\drbr.dll

    Sharon
     

    Attached Files:

    Sharon, Oct 9, 2004
    #19
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Sharon,

    Go here and download Erunt: http://www.majorgeeks.com/download1267.html
    Install it and use it to backup your registry.

    Then go back into the registry with registrar lite and delete the entries for superwebsearch.

    Don't touch the items in Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ you were seeing. Those were added by a program like SpyBot or SpywareBlaster to block them.

    After delete those superwebsearch entries let me know it you still get warnings about it.
    You log is in good shape.
     
    chaslang, Oct 10, 2004
    #20
  21. Sharon

    Sharon Private E-2

    Chaslang,
    The entries for superwebsearch are also in Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\. Yes, I'm still getting warnings about superwebsearch.
    Sharon
     
    Sharon, Oct 10, 2004
    #21
  22. Sharon

    Sharon Private E-2

    Changlang,
    I ran Spybot again in safemode and it came up with this:
    CoolWWWSearch: IE Search page (Registry change, nothing done)
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page=http://www.google.com
    and this is what's in the registry:
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\
    http://www.superwebsearch.com/ie/
    Before I had Spybot restore it, the registry had an entry:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page=http://www.coolwwwsearch.com$
    When I had Spybot repair it I wasn't able to connect to the internet. So, I had to have it restored.
    Sharon
     

    Attached Files:

    Sharon, Oct 10, 2004
    #22
  23. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Sharon,

    Please do not have notepad running when doing HJT scans.

    I think you are running into conflicts fixing things due to SpywareGuard, SpywareBlaster, Spy Sweeper, and SpyBot protections. I want you to boot into safe mode and disable all of their protection options. If you cannot figure out how to do that, you could uninstall them and reinstall later (you could just disconnect you PC from the internet during this time when uninstalled or disabled).

    The while in still safe mode, run HJT and nothing else and fix:
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.superwebsearch.com/ie/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.webroot.com/php/disp0201.php?pc=4060&rc=551&ps=R&oc=2&mjv=5&mnv=5&bld=19&cd=&dcc=&drc=&mo=2&sid=

    Now reset your web settings:

    Reset Web Settings by clicking Start, Control Panel (for some systems it may be Start, Settings, Control Panel) and select Internet Options. Then click Programs and click the Reset Web Settings button. Then go back to the General tab and set your home page back to what you like (i.e., www.majorgeeks.com). Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

    Now use Registrar Lite to search your registry for superwebsearch, if you find it anywhere other than Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ you should delete the entry.

    Now reboot in normal mode, re-enable or re-install your applications and tell me how things look now.
     
    chaslang, Oct 10, 2004
    #23
  24. Sharon

    Sharon Private E-2

    I apologize about notepad, I was reading your directions and forgot to close it. Did as you said. Rebooted to normal mode, Spysweeper and SpywareGuard
    warned of the pages being changed to www.superwebsearch.com again. Registar Lite didn't find anything other than Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
    I went to Panda online scan last night, it came back clean.
    Sharon
     

    Attached Files:

    Sharon, Oct 10, 2004
    #24
  25. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I asked you to disable or uninstall SpySweeper, SpywareGuard etc before making any changes.

    In fact I would like to see all of them uninstalled, a reboot, and then a new log (without them running). I think they are either making it difficult to fix or they are not allowing something to show that we need to see.
     
    chaslang, Oct 10, 2004
    #25
  26. Sharon

    Sharon Private E-2

    I did all of this in safemode. They were not running. I ran HJT in safemode also.
     
    Sharon, Oct 10, 2004
    #26
  27. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You HJT log shows them to be running!
     
    chaslang, Oct 10, 2004
    #27
  28. Sharon

    Sharon Private E-2

    I owe you an apology, I'm sorry! After I disabled the software I should have rebooted into safe mode again.

    I disabled everything (I hope). Did as you said. When I rebooted into normal mode and turned everything on, I still got the same warnings. Could there possibly be something that's in the bios?

    There were two copies of superwebsearch in Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\

    Sharon
     

    Attached Files:

    Sharon, Oct 10, 2004
    #28
  29. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    No the BIOS is not infected. Do you have multiple user accounts on this PC? Like Administrator and any others. If so, it would be a good idea to run all the cleaning tools for each account. I not sure were this hijacker is hiding if it does not show in the registry of HJT log.

    Did you try searching the registry for super-websearch as well?

    Both should be in ZoneMap\Domains but I would expect no place else.

    Try this too:
    • Right-click on the desktop.
    • Select "Properties" menu item.
    • Select the "Desktop" tab.
    • Pres the "Customize Desktop" button.
    • Select the "Web" tab.
    • Unselect the "Search" checkbox.
     
    chaslang, Oct 10, 2004
    #29
  30. Sharon

    Sharon Private E-2

    No, I'm the only account on this machine. Yes, I've searched the registry and can't find anything. With everything I've read all over the net, and all the files superwebsearch is supposed to leave, I can't find any of them on this computer, not from any varient. What baffles me is, all the times I've run everything in safe mode, spybot didn't find anything until today. One thing I did notice the last time I booted back to normal mode, something flashed quickly in the background as windows booted to the desktop. What if I set up another account as administrator and try to clean everything again? Would that make a difference? I don't want to have to reformat again. I'd have to backup a lot of stuff, and that leaves the possibility of backing up this bug.
    Sharon
     
    Sharon, Oct 10, 2004
    #30
  31. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you run the steps I gave you in the bullet list?
     
    chaslang, Oct 10, 2004
    #31
  32. Sharon

    Sharon Private E-2

    Yes.
     
    Sharon, Oct 11, 2004
    #32
  33. Sharon

    Sharon Private E-2

    Chaslang,
    I rebooted my computer into safemode, this time logging on as administrator. Went through all the directions you have given me. Got all the same results. The only difference is when I ran Registrar Lite it didn't find superwebsearch, not even in Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
    I'm attaching a HJT log from safe mode and normal mode.
    Sharon
     

    Attached Files:

    Sharon, Oct 11, 2004
    #33
  34. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you see the same problem with superwebsearch when you were logged in as administrator?

    By the way I don't need anymore HJT logs. They have not shown any problems in quite a while.
     
    chaslang, Oct 11, 2004
    #34
  35. Sharon

    Sharon Private E-2

    SpywareGuard and Spy Sweeper warned the search pages were being changed to http://www.superwebsearch.com/ie/
     
    Sharon, Oct 11, 2004
    #35
  36. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'm not sure what is going on here. This is not making sense.

    The only thing I can thing of doing right now is for you to uninstall SpywareGuard and SpySweeper (and Spyware Blaster too if you have it protecting your IE settings). After uninstall, reboot you PC. Do not re-install them yet.

    Now after reboot run your browser, check you home page. What is it set to? Run HJT and see what the R0 & R1 lines show. Post them back here. Open and close a few browser sessions and see if any of those R0 & R1 lines change.

    If you don't see any problems reinstall only one of the three programs we uninstalled (let's install SpySweeper first).

    Let me know what the result of all this is.
     
    chaslang, Oct 12, 2004
    #36
  37. Sharon

    Sharon Private E-2

    Both IE6 and Mozilla Firefox kept their homepages to www.majorgeeks.com.
    After installing Spy Sweeper and rebooting, I didn't get any warnings. I'm only posting one HJT log because they were identical. One thing I noticed last night, every setting of Trend firewall had been reset to disable. That wasn't the way it was set up. If my modem is disconnected when booting up, the computer boots quite fast like it did before this mess with it connected. If it's connected it takes close to three minutes to boot. This makes me think there is something in the background trying to take over.
    Sharon
     

    Attached Files:

    Sharon, Oct 12, 2004
    #37
  38. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your HJT kig does not indicate that Spy Sweeper is installed. It does show Webroot's Window Washer but not Spy Sweeper. Are you sure it is installed and running? Is this log from before it was reinstalled?

    So right now there are no warnings about your search pages being changed?

    If you re-enable your firewall settings, does it have any impact of the boot speed?

    Try enabling your firewall settings and booting your PC again without your modem (is this DSL or Cable) connected. Now plug in your modem and at a command prompt window enter the following commands:
    ipconfig /release
    ipconfig /renew

    See if your firewall shows a lot of activity (incoming & outgoing items being blocked).
     
    chaslang, Oct 12, 2004
    #38
  39. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    chaslang, Oct 12, 2004
    #39
  40. Sharon

    Sharon Private E-2

    No, it isn't related to: http://kb.trendmicro.com/solutions/...olutionID=18278
    My computer was pretty fast until this mess.
    The log was before I re-installed Spy Sweeper. I will attach a new one. I re-enabled my firewall settings last night. It has shown activity from Internet Assigned Numbers Authority, Asia Pacific Network Information Centre, UUNET Technologies, Inc., ThePlanet.com Internet Services, Inc., and Earthlink, Inc.
    I'm on cable. I'll also attach the results of the commands. Why isn't Spy Sweeper giving me any warnings now that I don't have SpywareGuard or Spyware Blaster installed? Is it possible the spyware is finally gone? I don't want to get my hopes up!
    Sharon
     

    Attached Files:

    Sharon, Oct 12, 2004
    #40
  41. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your HJT log still looks fine. Next step...install only SpywareBlaster. Let's see if you still get no warnings.

    If that link I gave you does not pertain, I don't know why you have slow boot up.
     
    Last edited: Oct 12, 2004
    chaslang, Oct 12, 2004
    #41
  42. Sharon

    Sharon Private E-2

    Installed SpywareBlaster, no problems. HJT log is identical to the one posted.
     
    Sharon, Oct 12, 2004
    #42
  43. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! Let's put in the last one that we removed...SpywareGuard. Now is everything still okay.
     
    chaslang, Oct 13, 2004
    #43
  44. Sharon

    Sharon Private E-2

    Re-installed SpywareGuard. Rebooted twice without warnings. HJT log looks fine.
     
    Sharon, Oct 13, 2004
    #44
  45. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! That's good! So the only problem you have now is that your system boot up seems very slow but it is okay if your modem is disconnected. Is that right?
     
    chaslang, Oct 13, 2004
    #45
  46. Sharon

    Sharon Private E-2

    Yes, that's right. It seems to be getting a little better. One other problem that's happened since all this (or it's a coincidence) my scanner will not work. I've un-installed and installed at least four times. It's the same error, scanner dll not found.

    Sharon
     
    Sharon, Oct 13, 2004
    #46
  47. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you reboot after you uninstalled and before reinstalling? If not, try that. Otherwise note the DLL name and see if you can locate it on the installation disk (probably not) so you can copy it to your PC. Also search for the DLL on your PC.
     
    chaslang, Oct 13, 2004
    #47
  48. Sharon

    Sharon Private E-2

    With all your hours of help, the spyware problem is hopefully solved. Thank you very much!

    Yes, I did reboot for both. I can't find the DLL on the installation disk. It was on the pc. The scanner probably died. Plustek hasn't put out drivers for the model I have and most likely won't. I'm probably going to buy an Epson scanner.
    Sharon
     
    Sharon, Oct 14, 2004
    #48
  49. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If the DLL file is still on your PC, you may just have to re-register it. Open a command prompt window and change directory to the directory where you located the dll. And enter the below command. Replace filename.dll with your actual filename.

    regsvr32 filename.dll
     
    chaslang, Oct 14, 2004
    #49
  50. Sharon

    Sharon Private E-2

    Did as you said, got the scanner working. It sounded like it was grinding glass. I think it bit the dust!
    Thank you,
    Sharon
     
    Sharon, Oct 15, 2004
    #50
Page 1 of 2

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds