PDA

View Full Version : Omega-Search once again!!!!

Shawn Shaker
12 Apr 2004, 1:29pm
Hi,

I read your removal guide and followed all steps. I even read hwkuser's Thread and followed those steps too but I couldn't get rid of damn Omegasearch. I still have this strange toolbar, or whatever it is ...

Here is my log file. Thanks for evey help I get.

Logfile of HijackThis v1.97.7
Scan saved at 15:26:00, on 12.04.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
E:\Programme\Norton Internet Security\NISUM.EXE
E:\Programme\Norton Internet Security\ccPxySvc.exe
C:\WINDOWS\System32\gearsec.exe
E:\Programme\Norton AntiVirus\navapsvc.exe
C:\Program Files\Linksys\Wireless-B Notebook Adapter\NICServ.exe
E:\Programme\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
E:\PROGRA~1\NORTON~3\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Gemeinsame Dateien\Logitech\QCDriver\LVCOMS.EXE
E:\Programme\iTunes\iTunesHelper.exe
C:\PROGRA~1\Style clock jugs\copy peak.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Company\Quick Start Button\QSB.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\Nokia\PC Suite for Nokia 6600\connmngmntbox.exe
C:\Programme\Nokia\PC Suite for Nokia 6600\ectaskscheduler.exe
C:\Program Files\Linksys\Wireless-B Notebook Adapter\WPC11Cfg.exe
C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
C:\Programme\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
C:\Programme\Internet Explorer\iexplore.exe
E:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE
E:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE
E:\Downloads\Programme\anti omegasearch\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://omegasearch.com/passthrough/index.html?http://www.google.de/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [LVCOMS] C:\Programme\Gemeinsame Dateien\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iTunesHelper] E:\Programme\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [one face] C:\PROGRA~1\Style clock jugs\copy peak.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [QSB] C:\Programme\Company\Quick Start Button\QSB.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Programme\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: PCSuiteForNokia6600 Detect.lnk = ?
O4 - Global Startup: PCSuiteForNokia6600 TS.lnk = ?
O4 - Global Startup: Wireless-B Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-B Notebook Adapter\WPC11Cfg.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Recherchieren (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/bff3af7d050da5/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37901.5574189815
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

I always deleted the first entry but it always comes back!!!
Dexter
12 Apr 2004, 3:19pm
Updated Removal Instructions here: http://www.short-media.com/forum/showthread.php?t=12173

Try that and post back to let us know.

Dexter...
Dexter
12 Apr 2004, 3:22pm
Hah! Looks like you have a new variant. Delete these buggers:

C:\PROGRA~1\Style clock jugs\copy peak.exe

O4 - HKLM\..\Run: [one face] C:\PROGRA~1\Style clock jugs\copy peak.exe

I am noticing the word "Jugs" in various files on many of these Omegasearch HJT logs. It must be a keyword in a random file naming system.

And of course, remove:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://omegasearch.com/passthrough/.../www.google.de/

Try that and let us know. Post back later to let us know, then also post a new HJT log, as there a few items we can help you clean to tune things up a little :)

Dexter...
Shawn Shaker
12 Apr 2004, 3:25pm
ok, thanks a lot
I will try it right now :) and let you know if it works
Straight_Man
12 Apr 2004, 3:41pm
Also, try looking here:

http://www.computercops.biz/postt23654.html

"best-offer-for-you.ws" entries need to be pulled also. In this case, run HijackThis's Internet options to see if you have any, and pull any entries in above thread link that Pieter says to pull-- he IS a Microsoft Most Valuable Player for Microsoft Security.

Essentially, the things he lists in the Internet area are websites that will refeed what you are fighting when you go online after killing this set of things. This kind of thing is one reason I use Sun Java based browsers.

Also run SpyBot S&D, updated to latest defs. It can pull part of this crap and other things.

John D.
Shawn Shaker
12 Apr 2004, 4:22pm
Thanks Dexter!!!!

Seems like Omegasearch is gone now. I deleted the Folder you told me about! And then it finally seems to be gone! :bigggrin: You made my day!

Is there anything people can do to fight omegasearch???

And here is my new log file:

Logfile of HijackThis v1.97.7
Scan saved at 18:13:53, on 12.04.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
E:\Programme\Norton Internet Security\NISUM.EXE
E:\Programme\Norton Internet Security\ccPxySvc.exe
C:\WINDOWS\System32\gearsec.exe
E:\Programme\Norton AntiVirus\navapsvc.exe
C:\Program Files\Linksys\Wireless-B Notebook Adapter\NICServ.exe
E:\Programme\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
E:\PROGRA~1\NORTON~3\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Gemeinsame Dateien\Logitech\QCDriver\LVCOMS.EXE
E:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Company\Quick Start Button\QSB.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\Nokia\PC Suite for Nokia 6600\connmngmntbox.exe
C:\Programme\Nokia\PC Suite for Nokia 6600\ectaskscheduler.exe
C:\Program Files\Linksys\Wireless-B Notebook Adapter\WPC11Cfg.exe
C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
E:\Downloads\Programme\anti omegasearch\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [LVCOMS] C:\Programme\Gemeinsame Dateien\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iTunesHelper] E:\Programme\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [QSB] C:\Programme\Company\Quick Start Button\QSB.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Programme\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: PCSuiteForNokia6600 Detect.lnk = ?
O4 - Global Startup: PCSuiteForNokia6600 TS.lnk = ?
O4 - Global Startup: Wireless-B Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-B Notebook Adapter\WPC11Cfg.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Recherchieren (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/bff3af7d050da5/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37901.5574189815
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Thanks again for all the help!
Dexter
12 Apr 2004, 6:50pm
Thanks Dexter!!!!

Seems like Omegasearch is gone now. I deleted the Folder you told me about! And then it finally seems to be gone! :bigggrin: You made my day!

Is there anything people can do to fight omegasearch???



Glad to hear it :)

And yes, there are several things you can do to prevent stuff like this.

First, read
this article on fighting spyware (http://www.short-media.com/review.php?r=132) by Short-Media's PrimeSuspect. Pay attention to the section titled "An Ounce Of Prevention." There are tips on how to change your browser security settings to prevent "drive-by" hijakcings.

Then, be very very careful about what you download and where you download it from. The types of programs I described in my article are notorious for malware.

If you use Kazaa, or any other P2P app, again, be very cautious about what you download. Double-check that files' extensions are what they should be, not an MP3 that is actually named "xxx/MP3.EXE."

Spybot Search and Destroy v 1.2 has preventative software for known malware, similar to anti-vius prevention. I would imagine they will have Omegasearch in their database pretty soon, and will be keeping up to date with new items. You may want to give it a try, you can get it here: http://download.com.com/3000-8022-10194058.html?tag=lst-0-1


Dexter...
Shawn Shaker
13 Apr 2004, 11:50am
Thanks again for your help and all the information

I will read it carefully.

Is there anything else I could clean up in my log file???
Kwitko
13 Apr 2004, 12:42pm
Spybot Search and Destroy v 1.2 has preventative software for known malware, similar to anti-vius prevention.

I would add SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html) to my preventative maintenance list. While Spybot is a great product, even *it* recommends you use SpywareBlaster. Spybot's immunization feature covers roughly 500 items, SpywareBlaster covers over 2800.