PDA

View Full Version : Need Help With Home Search Assistant!!! Please!!!

mikesike
2 Oct 2004, 12:21am
Hey,

I am experoencing problems with problems getting rid of Home Search Assistant, Shopping Wizard & Search Extender. It is hijacked my browser & creating of pop-ups. I have tried both adaware & Sptbot S&D, both have not been able to get rid of my problem. Can someone guide me through the process of choosing the files that harm me on my hijachthis log, because I have absolutly no Idea of how to read those thing.

Thanks in advance to everyone at Short-Media, and anyone who can help!
You guys are great!

This is my latest hijack this log:

-------------------------------------------------------------------------

Logfile of HijackThis v1.98.2
Scan saved at 4:12:24 PM, on 10/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\winnt.bmp:rqrmp
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Xerox\NWWia\XrxFTPLt.exe
C:\WINDOWS\system32\addsm32.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Michal.K-HO2QNFNAPEVBI\Local Settings\Temp\Temporary Directory 4 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\uaopv.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\uaopv.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\uaopv.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\uaopv.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\uaopv.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\uaopv.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\uaopv.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Rogers Hi-Speed Internet
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4B4A8F65-75F5-BF6A-F510-7AC13C50B331} - C:\WINDOWS\system32\sysob32.dll
O2 - BHO: brdg Class - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\System32\bridge.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [XeroxScannerDaemon] C:\Program Files\Xerox\NWWia\XrxFTPLt.exe
O4 - HKLM\..\Run: [addsm32.exe] C:\WINDOWS\system32\addsm32.exe
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [iezy.exe] C:\WINDOWS\system32\iezy.exe
O4 - HKCU\..\Run: [RHSI SHS] "C:\Program Files\Rogers Hi-Speed Internet\RHSI SelfHealing\SHS.exe" /background
O4 - HKCU\..\Run: [RHSI Update Manager] "C:\Program Files\Rogers Hi-Speed Internet\RHSI Update Manager\RHSIUpdateManager.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [wccapp] c:\documents and settings\michal.k-ho2qnfnapevbi\desktop\winlqt.exe
O9 - Extra button: Corel Network monitor worker - {6F18B2C6-E919-41DB-A4C2-7BFA53A2850F} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {6F18B2C6-E919-41DB-A4C2-7BFA53A2850F} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Corel Network monitor worker - {6F18B2C6-E919-41DB-A4C2-7BFA53A2850F} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {6F18B2C6-E919-41DB-A4C2-7BFA53A2850F} - (no file) (HKCU)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.hispeed.rogers.com
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchmiracle.com

-------------------------------------------------------------------------

What do I delete, and then what do I do?

Mike K.
SpywareShooter
2 Oct 2004, 12:23am
Welcome to Short Media Forums.

PLEASE DO NOT REBOOT YOUR COMPUTER UNTIL I TELL YOU TO!

Before doing the following, please Set your computer to show hidden files and folders (http://www.short-media.com/forum/showpost.php?p=172588&postcount=3), Disable System Restore (http://www.short-media.com/forum/showpost.php?p=172591&postcount=4), and Reboot in Safe Mode (http://www.short-media.com/forum/showpost.php?p=175908&postcount=6).

Once you have done that, Run HijackThis and have it fix the following:


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\uaopv.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\uaopv.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\uaopv.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\uaopv.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\uaopv.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\uaopv.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\uaopv.dll/sp.html#12802
O2 - BHO: (no name) - {4B4A8F65-75F5-BF6A-F510-7AC13C50B331} - C:\WINDOWS\system32\sysob32.dll
O2 - BHO: brdg Class - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\System32\bridge.dll
O4 - HKLM\..\Run: [addsm32.exe] C:\WINDOWS\system32\addsm32.exe
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [iezy.exe] C:\WINDOWS\system32\iezy.exe
O4 - HKCU\..\Run: [wccapp] c:\documents and settings\michal.k-ho2qnfnapevbi\desktop\winlqt.exe
O9 - Extra button: Corel Network monitor worker - {6F18B2C6-E919-41DB-A4C2-7BFA53A2850F} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {6F18B2C6-E919-41DB-A4C2-7BFA53A2850F} - (no file)
O9 - Extra button: Corel Network monitor worker - {6F18B2C6-E919-41DB-A4C2-7BFA53A2850F} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {6F18B2C6-E919-41DB-A4C2-7BFA53A2850F} - (no file) (HKCU)
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchmiracle.com


Then find and delete the following files:
[b]
C:\WINDOWS\uaopv.dll
C:\WINDOWS\system32\sysob32.dll
C:\WINDOWS\System32\bridge.dll
C:\WINDOWS\system32\addsm32.exe
C:\Program Files\BullsEye Network\
C:\WINDOWS\system32\iezy.exe
c:\documents and settings\michal.k-ho2qnfnapevbi\desktop\winlqt.exe



Once you have done that, PULL THE PLUG ON YOUR COMPUTER! (do not go start shut down etc), scan with HiijackThis again, and post a new log.
mikesike
2 Oct 2004, 1:33am
Well I did all those steps

heres my newest log
-----------------------------------------------------------------------------------

Logfile of HijackThis v1.98.2
Scan saved at 5:23:05 PM, on 10/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\winnt.bmp:rqrmp
C:\WINDOWS\system32\ntpa32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Xerox\NWWia\XrxFTPLt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Michal.K-HO2QNFNAPEVBI\Local Settings\Temp\Temporary Directory 5 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\pmohx.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\pmohx.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\pmohx.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\pmohx.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\pmohx.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\pmohx.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\pmohx.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Rogers Hi-Speed Internet
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: brdg Class - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\System32\bridge.dll (file missing)
O2 - BHO: (no name) - {CE8C95DF-A478-EE5C-E911-BE35E557C173} - C:\WINDOWS\system32\ntpa32.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [XeroxScannerDaemon] C:\Program Files\Xerox\NWWia\XrxFTPLt.exe
O4 - HKLM\..\Run: [addsm32.exe] C:\WINDOWS\system32\addsm32.exe
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [iezy.exe] C:\WINDOWS\system32\iezy.exe
O4 - HKLM\..\Run: [ntpa32.exe] C:\WINDOWS\system32\ntpa32.exe
O4 - HKCU\..\Run: [RHSI SHS] "C:\Program Files\Rogers Hi-Speed Internet\RHSI SelfHealing\SHS.exe" /background
O4 - HKCU\..\Run: [RHSI Update Manager] "C:\Program Files\Rogers Hi-Speed Internet\RHSI Update Manager\RHSIUpdateManager.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [wccapp] c:\documents and settings\michal.k-ho2qnfnapevbi\desktop\winlqt.exe
O9 - Extra button: Corel Network monitor worker - {6F18B2C6-E919-41DB-A4C2-7BFA53A2850F} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {6F18B2C6-E919-41DB-A4C2-7BFA53A2850F} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Corel Network monitor worker - {6F18B2C6-E919-41DB-A4C2-7BFA53A2850F} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {6F18B2C6-E919-41DB-A4C2-7BFA53A2850F} - (no file) (HKCU)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.hispeed.rogers.com
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchmiracle.com

-----------------------------------------------------------------------------------

That doesn't look like too much progress.
But there was one thing I couldn't do: In step 2, where I have to delete those things, I couldn't find, (because it wasn't there) the follwing programs,

C:\WINDOWS\uaopv.dll
C:\WINDOWS\system32\sysob32.dll
C:\WINDOWS\System32\bridge.dll
c:\documents and settings\michal.k-ho2qnfnapevbi\desktop\winlqt.exe

These files just weren't there. And I did set my folders to show all files, just like the steps said.

Any help?

Mike K.
SpywareShooter
3 Oct 2004, 12:07am
Have you rebooted your computer since your last post? If you have, you will need to post a new log, and not reboot until I tell you to. I need to give you precise instructions to remove this, and rebooting will void them.