Sypbot cant rid ISearchTech.YSB

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by wkah, Aug 5, 2005.

  1. wkah

    wkah Private E-2

    File server OS: win2000server

    Tried a toolbar fix
    tried fixspy.reg (made it better)
    all of the sugested threads, but..

    Spybot still finds registry key:
    HKEY_LOCAL_MACHINE\SOFTWARE\YourSiteBar
    even in safe mode.

    spyware doctor finds it but you have to pay to remove it.

    Should I run one of the various free registry cleaners?
    pc tools has one
    www.tentopreviews.com has 20
    www.registryFix.com
    comparePCTuneUps.com
     
  2. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Please follow standard cleanup procedures as given below:

    - Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    Make sure you check version numbers and get all updates.

    - Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


    After doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps below:



    [​IMG] Download HijackThis 1.99.1

    [​IMG] Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    [​IMG] Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

    [​IMG]Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    [​IMG]Run HijackThis and save your log file.

    [​IMG] Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

    [​IMG]Need help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting
     
  3. wkah

    wkah Private E-2

    I performed the steps in section1 & but I got stuck on two downloads in section 2 and have not done the scanning and cleaning steps1-4:

    Spyware blaster downloaded OK but the install failed. "Error occurred while trying to relace the existing file. delete file failed. code 5; access denigned."

    about buster: ran the *.exe file but got the following error: database corupt or missing. Your thread states to unzip it to a folder, click update and download before scanning. If i need to be in safe mode to do this, the thread should read just unzip it to a folder and run later when in safe mode?
     
  4. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    AB should on be ran if you have the about:blank hijacker. Skip the parts you have trouble with as we will address them later. Procede with the READ ME and then attach a HJT log.
     
  5. wkah

    wkah Private E-2

    I tried to go to the next step as you suggested but I could not get my file server to boot in safe mode with networking. It hung for a long time on the screen prepairing network connections and hung even longer on loading personal settings. I eventually gave up. could this be due to the raid? or some other problem. could i do the bitdefender in just safe mode w/o networing?
     
  6. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Just run the scans in normal mode.
     
  7. wkah

    wkah Private E-2

    I was able to run scans in safe mode networking:
    Bitdefender found 3 & deleted them
    Spybot found 6, removed 5
    rescan w/ spybot same isearchtech.ysb still there.
    next step is Hijacker
     
  8. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    If you have ran the online scans then attach a current HJT log.
     
  9. wkah

    wkah Private E-2

    Here is the hijack log attached
     

    Attached Files:

  10. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Your HJT version is WAY out of date!

    Please update to Hijack This 1.99.1 and attach a new log using the new version.
     
  11. wkah

    wkah Private E-2

    how about now?
     

    Attached Files:

  12. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Are you familiar with these entries above?


    Please EXTRACT HijackThis from the ZIP File to a Safer location. Here's how:

    To create a new folder:
    Click START > My Computer > Local Disc C: > Program Files
    Now, Right Click on an Empty Area and select New > Folder & name it HijackThis and ENTER

    To Extract HijackThis:
    Now, Right Click your HijackThis ZIP File and select Extract All > Next > and browse to your newly created HijackThis Folder
    (C:\Program Files\HJT) and click Next.

    Now run HJT from there. Please save your HJT Log as a .txt File and attach it via the "Manage Attachments" tool in the Additional Options section when you post.

    The reason HJT needs its own safe folder is so that backups will be safely preserved. That way, if a mistake is made in the removal process, the mistakenly deleted entry can be restored.
     
  13. wkah

    wkah Private E-2

    I think 017 are PC anywhere domaines
    New hiJack log attached as a *.txt file run from it's own folder
     
  14. wkah

    wkah Private E-2

    017 those are setting for my local domain
    leave these
     
  15. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    You didnt attach anything?
     
  16. wkah

    wkah Private E-2

    oops i'll try again
    those are my local domain
     
  17. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Still didnt attach anything?
     
  18. wkah

    wkah Private E-2

    I'll try again
     
  19. wkah

    wkah Private E-2

    i'll try again
     

    Attached Files:

  20. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Scan with HijackThis and Check the Boxes for the following:

    Make sure All Browser Windows are Closed when you Click FIX.

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm

    O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)

    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

    Again, make sure All Browser Windows are Closed when you Click FIX.

    NEXT:
    Run CCleaner to clean up cookies and temp files.

    Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
    Note: Remember to get all updates before doing the scans.


    After you complete the above, reboot and let me know if any problems remain.
     
  21. wkah

    wkah Private E-2

    Did all that you recommended with hijackthis (r0,02,09):

    A. Spybot1.4 still scan IsearchTech.ysb (HKEY_LOCAL_MACHINE\SOFTWARE\YourSiteBar)

    B. Microsoft spyware beta 1 scans YourSiteBar KEY_LOCAL_MACHINE\SOFTWARE\YourSiteBar)

    C. Ad-adware scans two MRU list negligible objects

    Any additional suggestions?
     
  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixYS.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixYS.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes
    MRU's should be ignored unless you are really worried about a history log of what you are doing on the PC.

    Now how do things look?
     
  23. wkah

    wkah Private E-2

    I think that I did this already see opening thread aug 5 i think.
    Do you want me to do it again?
     
  24. wkah

    wkah Private E-2

    I did this fixYS.
    Microsoft antispy & spybot still find it:
    Hkey_Local_Machine\Software\YourSiteBar
    Any suggestions?
     
  25. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Download this trial version of Ewido Security Suite

    • Install ewido security suite
    • Launch ewido, there should be an icon on your desktop double-click it.
    • The program will have a window come up. One of the buttons on the left is to Update. Click the Update button.and then Start the Update. The update will start and a progress bar will show the updates being installed.
    • After it completes the update, click the Scanner button

    Now exit Ewido. Now print the below instructions or save them locally because I want you do have no browsers opened and also have no connection to the internet (unplug your cable) while doing the below.

    Okay, reboot into safe mode and follow the steps below. (If you have any problems at all trying to get into safe mode to complete these steps, just run them in normal boot mode and make sure you tell me when you come back.)

    Open up Ewido and do the following:


    • Click on Scanner
    • Then click Settings
    • Under What to Scan? Select Scan every file
    • Then click OK
    • Click on Complete System Scan and the scan will start.
    • Let the program scan the machine
    While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.

    Once the scan has completed, there will be a button located on the bottom of the screen named Save report


    • Click Save report
    • Save the report to your desktop or anyplace you will be able to find it to upload here.
    Reboot into normal mode and reconnect to the internet.

    Come back here and post the Ewido Scan Report.


    Also post a current HJT log.
     
  26. wkah

    wkah Private E-2

    Same results after scan with spybot & MS spyware
     
  27. wkah

    wkah Private E-2

    see attachments of scan results
     

    Attached Files:

  28. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Uninstall Spyware Cleaner! It is a rogue tool. See: http://www.spywarewarrior.com/rogue_anti-spyware.htm

    If you cannot find and uninstall for it, use HJT to fix the below line:
    O4 - HKCU\..\Run: [Spyware Cleaner] "C:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot

    And delete the C:\Program Files\Spyware Cleaner folder after reboot.

    Now uninstall Microsoft Antispyware and Spybot S&D. Now reboot your PC and run another Ewido Scan and also try the registry patch I gave you in message # 22 again.

    Post a new HJT log afterwards.
     
  29. wkah

    wkah Private E-2

    I did everything except I was not able to find the folder inside my program files "spyware cleaner" to delete.
    Is it the same as CCleaner (I did not delete this folder)?
    I did however use HJT 04...

    I ran Ewido (not in safe mode) but as you can see there is still an error in removing the files.

    As an unrelated issue I think, on boot up i got an error "at least 1 driver failed during startup"
     

    Attached Files:

  30. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I just noticed you have never installed HijackThis properly per BJ's first message. Please fix this. You still have it running from a temp folder which is also in Documents and Settings.
    C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ICEOWS\ViewUpd\HijackThis.exe


    Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
    On the page that opens, scroll down to MAPI Mail Client (or if not found look for MAPI) ... then right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.

    Now repeat the above for:
    SpywareCleanerService

    Next, go back to HJT and select 'Delete an NT Service" ... copy/paste the following into the box that opens, and press "OK":

    MAPI Mail Client

    If that does not work try entering the short name: MAPI

    Now repeat the above for:
    SpywareCleanerService

    Now exit HJT but and reboot into safe mode.

    Delete the below if found:
    C:\WINNT\system32\mapi32.exe <-- do not delete mapi.dll or mapi32.dll. They are valid.
    C:\Program Files\Spyware Cleaner <--- the folder

    Try merging in the registry patch again for removing YourSiteBar also run Ewido in safe mode right after this and see if it still pick it up.

    Now reboot in normal mode. Post a new HJT log and tell me how things are working. See what Ewido picks up now in normal boot mode.
     
  31. wkah

    wkah Private E-2

    Mapi mail Client & SpywareCleanerService were already in stopped service,
    I changed the start-up from automatic to disabled as instructed.
    Then deleted both in HJT as instructed.
    In safe Mode the two files were not found (C:\winnt\System32\mapi32.exe & Program files\Spyware cleaner).
    Ran the registry patch
    Ran Ewido: found the same two files YourSiteBar...error clearing...see report
    Reboot in normal mode: HJT see report
    Ran Ewido: found the same two files...see report
     

    Attached Files:

  32. wkah

    wkah Private E-2

    HJT log
     
  33. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You forgot the HJT log but do not post one yet. Post after doing the below.

    Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixYS.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.)

    Do not run this patch yet. First boot into safe mode with no network support and do not open any browsers or running anything but what I request.

    After booting in safe mode, run Windows Explorer and locate and double-click on the fixYS.reg file on your desktop and when it prompts to Add in to the registry, say yes.
    While still in safe mode look for the below folder and delete it if found:
    C:\Program Files\YourSiteBar

    Now reboot into normal mode and tell me what happen while doing this. Also let me know if Ewido still finds the problem. Also post a new HJT log.
     
  34. wkah

    wkah Private E-2

    added the fixYS.reg in safe mode
    could not find c:\program files\YourSiteBar
    Reboot in normal mode: nothing unusual happened
    ewido found 2 (same?) infected files. see post
    HJT posted new log
    What do you think of doing the tune-up utilities 2006.
    It has a registry cleanup.
     

    Attached Files:

  35. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you notice a new BHO line showed up now?

    O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)

    This is from YourSiteBar. Have HJT fix this line and also run that registry patch again.

    I have no experince with tune-up utilities 2006. You would be better off asking that question in Software Forum, however right now I would ask "for what purpose"?
     
  36. wkah

    wkah Private E-2

    HJT did not fix 03 toolbar,
    ran regYS fix
    HJT log attached
     

    Attached Files:

  37. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I just realize that you never installed HJT properly per BJ's first message. You need to fix this. You are running it from exactly where requested not to run it. This not the cause of your problems but it does need to be corrected.

    Click Start, and then click Run. (The Run dialog box appears.)
    Type, or copy and paste, the following text:
    regsvr32 /u ys2.dll
    then click OK. If a dialog box confirming this action appears, click OK. If you get an error message, just ignore it and continue but tell me when you come back.

    Click Start, and then click Run. (The Run dialog box appears.)
    Type, or copy and paste, the following text:
    regsvr32 /u ysb.dll
    then click OK. If a dialog box confirming this action appears, click OK. If you get an error message, just ignore it and continue but tell me when you come back.

    - Download Registrar Lite and install it!
    - Run it, copy and paste this line to Reglite's address bar:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
    - Click the "go" tab
    - See if you can locate this 86227D9C-0EFE-4f8a-AA55-30386A3F5686 item. If so, right click on it and select delete.

    Then repeat by looking for the below key:

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser

    and then locate and delete the 86227D9C-0EFE-4f8a-AA55-30386A3F5686 key again.


    Now Download the Registry Search Tool

    Unzip to your Desktop and double click on regsrch.vbs
    (if you have script protection, please allow this to run)

    In the dialog that opens enter the following:

    ysb

    Press 'OK'

    The search will run for a while then alert you when it is finished. Press 'OK' and copy the contents of the WordPad window and post in this thread. If it is very long, an attachment would be better.

    Then repeat the registry search but this time look for YourSiteBar
    Attach or copy the output from this search here too.

    Also search your PC for the below files but see further down for how to configure Windows search. And if found, delete them. Let me know what you find.
    ysbinstall_1000489_3.exe
    ysbinstall_1002755_3.exe
    auto_update_uninstall.exe
    auf0.exe
    b_434_2_2_278300.htm
    cfin
    cxtpls.dll
    prompt[1].htm
    shortcuts.txt
    yoursitebar.xml
    ysb[1].dll
    ysb_prompt[1].htm
    ysb_prompt[2].htm
    ysb.dll
    ysbactivex.dll



    If you use Search, you need to do the following:
    Click Search and the Select "All files and folders"
    Enter the filename in the "All or part of the file name:" box, so enter ysbinstall_1000489_3.exe
    Now select "More advanced options"
    Make sure the following check boxes are checked:
    - Search system folders
    - Search hidden files and folders
    - Search subfolders
    Then click the Search button. If found, right click and select delete.
    Then repeat for the other files.
     
    Last edited: Sep 27, 2005
  38. wkah

    wkah Private E-2

    regsvr32 /u ys2.dll & regsvr32 /u ysb.dll: LoadLibrary ("regsvr32..") failed-the specified module could not be found. Reg lite found & I deleted both keys posted.
    Reg search found ysb & your site bar: both uploaded attached. Search files/folders (hidden files were not an option in advanced search) did not find any of the list you posted.
    PS. how do I fix the HJT installation?
     

    Attached Files:

  39. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Locate each of the below registry keys using RegistrarLite and select it. Then look at the Value in the Data field. Tell me what you see for each one.


    HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\yoursitebar.com
    HKEY_USERS\S-1-5-21-842925246-796845957-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\yoursitebar.com
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ysbweb.com
    HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ysbweb.com
    HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ysbweb.com
    HKEY_USERS\S-1-5-21-842925246-796845957-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ysbweb.com
    HKEY_USERS\S-1-5-21-842925246-796845957-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ysbweb.com
     
  40. wkah

    wkah Private E-2

    HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\yoursitebar.com: 4(0x04)

    HKEY_USERS\S-1-5-21-842925246-796845957-682003330-500 Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\yoursitebar.com: none

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ysbweb.com: default 5(0x05)

    HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ysbweb.com: default 5(0x05)

    HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ysbweb.com: 4(0x04)

    HKEY_USERS\S-1-5-21-842925246-796845957-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\ysbweb.com: none

    HKEY_USERS\S-1-5-21-842925246-796845957-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ysbweb.com: none

    PS. how do I fix the HJT installation?
     
  41. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    To get hijackthis.exe extracted from the ZIP File into the location we requested do the following.

    The below will work for WinXP based system since it can deal with ZIP files.
    You need to create the C:\Program Files\HJT folder. Do the following:
    - Click START and select Explore.
    - Select the drive where Windows is installed (normally C:)
    - Navigate to the C:\Program Files folder and select it.
    - Now click the on the top menu where it says File and then select New.
    - Then select Folder
    - A new folder is created and highlighted.
    - Just type HJT to overwrite the default name (New Folder)

    To extract hijackthis.exe:
    - locate the HijackThis.zip file you downloaded and right click on it
    - Select Extract All and click Next
    - Browse your way to the C:\Program Files\HJT folder created above
    - Select the folder and click Next

    Using Winzip:
    - locate the HijackThis.zip file you downloaded and right click on it and select Extract to. This will open Winzip.
    - Use the Folders/drives navigation pane to locate and select the C:\Program Files\HJT folder you previously created. After selecting it, make sure it shows in th Extract to: box.
    - Click the Extract button

    Before doing the below, first please uninstall Ewido and then reboot.

    Copy the contents of the Quote Box below to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixYSB.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then Double-click on the fixYSB.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to add into the registry say yes.
    Now repeat the RegSrch tool searches for ysb and YourSiteBar

    Now reinstall Ewido and run a new scan and post the log.
     
  42. wkah

    wkah Private E-2

    Now I have duplicate files:
    c:\program files\Hijack This\Hijackthis.exe
    c:\program files\Hijack This\Hijackthis.zip

    unable to run fixYSB.reg. Registry error: cannot import c:\....Error accessing the registry
     
  43. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Those are not duplicates. One is a .exe file (the actual Hijackthis program executable) and one is a .zip file (the file you downloaded).


    I had a couple typos! Try to import this version:
     
  44. wkah

    wkah Private E-2

    I have the following 4 files:
    c:\program files\Hijack This\Hijackthis.exe
    c:\program files\Hijack This\Hijackthis.zip
    c:\program files\HJT\Hijackthis.exe
    c:\spyware Tools\96HSRemoval1991\Hijackthis.zip
    regsrch tool shows attached
     

    Attached Files:

  45. wkah

    wkah Private E-2

    also ewido new scan shows attached
     

    Attached Files:

  46. wkah

    wkah Private E-2

    Can you give me any help?
     
  47. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

  48. wkah

    wkah Private E-2

    same problem but ist...exe did not show any sign of running.
     
  49. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you try the Active X version?

    And as far as your HJT copies go:
    You only need one!

    So keep this: c:\program files\Hijack This\Hijackthis.exe
    or this: c:\program files\HJT\Hijackthis.exe

    Either is fine.
     
  50. wkah

    wkah Private E-2


MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds