To talk on Icrontic, just register!

It only takes 30 seconds.

Have an account? Sign in:

Forgot?

To reopen your thread, send a Private Message (PM) to Trogan with a link to your thread.

If you are not the user who started this thread, you must start your own thread instead.

 
Reply to Discussion Options
Shawn Shaker
New to the neighborhood
Shawn Shaker
4 Posts
12 Apr 2004, 1:29pm

Omega-Search once again!!!!

Hi,

I read your removal guide and followed all steps. I even read hwkuser's Thread and followed those steps too but I couldn't get rid of damn Omegasearch. I still have this strange toolbar, or whatever it is ...

Here is my log file. Thanks for evey help I get.

Logfile of HijackThis v1.97.7
Scan saved at 15:26:00, on 12.04.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
E:\Programme\Norton Internet Security\NISUM.EXE
E:\Programme\Norton Internet Security\ccPxySvc.exe
C:\WINDOWS\System32\gearsec.exe
E:\Programme\Norton AntiVirus\navapsvc.exe
C:\Program Files\Linksys\Wireless-B Notebook Adapter\NICServ.exe
E:\Programme\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
E:\PROGRA~1\NORTON~3\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Gemeinsame Dateien\Logitech\QCDriver\LVCOMS.EXE
E:\Programme\iTunes\iTunesHelper.exe
C:\PROGRA~1\Style clock jugs\copy peak.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Company\Quick Start Button\QSB.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\Nokia\PC Suite for Nokia 6600\connmngmntbox.exe
C:\Programme\Nokia\PC Suite for Nokia 6600\ectaskscheduler.exe
C:\Program Files\Linksys\Wireless-B Notebook Adapter\WPC11Cfg.exe
C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
C:\Programme\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
C:\Programme\Internet Explorer\iexplore.exe
E:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE
E:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE
E:\Downloads\Programme\anti omegasearch\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://omegasearch.com/passthrough/i...www.google.de/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [LVCOMS] C:\Programme\Gemeinsame Dateien\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iTunesHelper] E:\Programme\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [one face] C:\PROGRA~1\Style clock jugs\copy peak.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [QSB] C:\Programme\Company\Quick Start Button\QSB.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Programme\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: PCSuiteForNokia6600 Detect.lnk = ?
O4 - Global Startup: PCSuiteForNokia6600 TS.lnk = ?
O4 - Global Startup: Wireless-B Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-B Notebook Adapter\WPC11Cfg.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Recherchieren (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/b...ll/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...901.5574189815
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab

I always deleted the first entry but it always comes back!!!
Dexter
Former SM Staff Member
Dexter
3,580 Posts
12 Apr 2004, 3:19pm
Updated Removal Instructions here: http://www.short-media.com/forum/showthread.php?t=12173

Try that and post back to let us know.

Dexter...
__________________ "Forty-two," said Deep Thought, with infinite majesty and calm.

Put your computer's spare power to work searching for the cure to diseases: Folding@Home. Join Team 93 today! Join a winning team, and help Fold for a Cure!
Get spyware fighting tools at our Security Downloads Page. Get a better browser: Get Firefox. Get Firefox!

[folding_sig1]
Dexter
Former SM Staff Member
Dexter
3,580 Posts
12 Apr 2004, 3:22pm
Hah! Looks like you have a new variant. Delete these buggers:

C:\PROGRA~1\Style clock jugs\copy peak.exe

O4 - HKLM\..\Run: [one face] C:\PROGRA~1\Style clock jugs\copy peak.exe

I am noticing the word "Jugs" in various files on many of these Omegasearch HJT logs. It must be a keyword in a random file naming system.

And of course, remove:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://omegasearch.com/passthrough/.../www.google.de/

Try that and let us know. Post back later to let us know, then also post a new HJT log, as there a few items we can help you clean to tune things up a little

Dexter...
Shawn Shaker
New to the neighborhood
Shawn Shaker
4 Posts
12 Apr 2004, 3:25pm
ok, thanks a lot
I will try it right now and let you know if it works
Straight_Man
Playing with Virtual Painter
Straight_Man
3,716 Posts
12 Apr 2004, 3:41pm
Also, try looking here:

http://www.computercops.biz/postt23654.html

"best-offer-for-you.ws" entries need to be pulled also. In this case, run HijackThis's Internet options to see if you have any, and pull any entries in above thread link that Pieter says to pull-- he IS a Microsoft Most Valuable Player for Microsoft Security.

Essentially, the things he lists in the Internet area are websites that will refeed what you are fighting when you go online after killing this set of things. This kind of thing is one reason I use Sun Java based browsers.

Also run SpyBot S&D, updated to latest defs. It can pull part of this crap and other things.

John D.
Shawn Shaker
New to the neighborhood
Shawn Shaker
4 Posts
12 Apr 2004, 4:22pm
Thanks Dexter!!!!

Seems like Omegasearch is gone now. I deleted the Folder you told me about! And then it finally seems to be gone! You made my day!

Is there anything people can do to fight omegasearch???

And here is my new log file:

Logfile of HijackThis v1.97.7
Scan saved at 18:13:53, on 12.04.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
E:\Programme\Norton Internet Security\NISUM.EXE
E:\Programme\Norton Internet Security\ccPxySvc.exe
C:\WINDOWS\System32\gearsec.exe
E:\Programme\Norton AntiVirus\navapsvc.exe
C:\Program Files\Linksys\Wireless-B Notebook Adapter\NICServ.exe
E:\Programme\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
E:\PROGRA~1\NORTON~3\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Gemeinsame Dateien\Logitech\QCDriver\LVCOMS.EXE
E:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Company\Quick Start Button\QSB.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\Nokia\PC Suite for Nokia 6600\connmngmntbox.exe
C:\Programme\Nokia\PC Suite for Nokia 6600\ectaskscheduler.exe
C:\Program Files\Linksys\Wireless-B Notebook Adapter\WPC11Cfg.exe
C:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
C:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
C:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
E:\Downloads\Programme\anti omegasearch\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [LVCOMS] C:\Programme\Gemeinsame Dateien\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iTunesHelper] E:\Programme\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [QSB] C:\Programme\Company\Quick Start Button\QSB.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Programme\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: PCSuiteForNokia6600 Detect.lnk = ?
O4 - Global Startup: PCSuiteForNokia6600 TS.lnk = ?
O4 - Global Startup: Wireless-B Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-B Notebook Adapter\WPC11Cfg.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Recherchieren (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/b...ll/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...901.5574189815
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab

Thanks again for all the help!
Dexter
Former SM Staff Member
Dexter
3,580 Posts
12 Apr 2004, 6:50pm
Quoting Shawn Shaker
Thanks Dexter!!!!

Seems like Omegasearch is gone now. I deleted the Folder you told me about! And then it finally seems to be gone! You made my day!

Is there anything people can do to fight omegasearch???
Glad to hear it

And yes, there are several things you can do to prevent stuff like this.

First, read
this article on fighting spyware by Short-Media's PrimeSuspect. Pay attention to the section titled "An Ounce Of Prevention." There are tips on how to change your browser security settings to prevent "drive-by" hijakcings.

Then, be very very careful about what you download and where you download it from. The types of programs I described in my article are notorious for malware.

If you use Kazaa, or any other P2P app, again, be very cautious about what you download. Double-check that files' extensions are what they should be, not an MP3 that is actually named "xxx/MP3.EXE."

Spybot Search and Destroy v 1.2 has preventative software for known malware, similar to anti-vius prevention. I would imagine they will have Omegasearch in their database pretty soon, and will be keeping up to date with new items. You may want to give it a try, you can get it here: http://download.com.com/3000-8022-10...ml?tag=lst-0-1


Dexter...
Shawn Shaker
New to the neighborhood
Shawn Shaker
4 Posts
13 Apr 2004, 11:50am
Thanks again for your help and all the information

I will read it carefully.

Is there anything else I could clean up in my log file???
Kwitko
Sheriff of Dicktown
Kwitko
6,521 Posts

» Subscriber

13 Apr 2004, 12:42pm
Quoting Dexter
Spybot Search and Destroy v 1.2 has preventative software for known malware, similar to anti-vius prevention.
I would add SpywareBlaster to my preventative maintenance list. While Spybot is a great product, even *it* recommends you use SpywareBlaster. Spybot's immunization feature covers roughly 500 items, SpywareBlaster covers over 2800.
__________________ "Is it not cruel to let our city die by degrees, stripped of all her proud monuments, until there will be nothing left of all her history and beauty to inspire our children?... this is the time to take a stand, to reverse the tide, so that we won't all end up in a uniform world of steel and glass boxes." - Jacqueline Kennedy Onassis
Similar Threads
Thread Thread Starter Forum Replies Last Post
NEW Omega ATI Catalyst 4.3 Released SM-Bot Technology Articles 0 21 Mar 2004 10:10pm
NEW Omega Catalyst 4.2 drivers SM-Bot Technology Articles 0 15 Feb 2004 7:19pm
NEW ATI Omega drivers 98/ME/2000/XP SM-Bot Technology Articles 2 26 Jan 2004 6:07am
NEW Omega Catalyst Drivers v2.4.96c Released (2000/XP) SM-Bot Technology Articles 0 9 Nov 2003 10:14pm
Omega Says "Goodbye" To NVidia Driver Creation SimGuy Technology Articles 24 15 Jul 2003 8:31pm

Go Back   Icrontic Forums > Malware Help > Spyware & Virus Removal > Resolved / Inactive
Reload this Page Omega-Search once again!!!!
Jump to
This Thread Search this Thread
Search this Thread:

Advanced Search

Today's Posts - Mark All Read - Contact Us - Icrontic.com - Archive - Top

Current time: 6:08pm (GMT)
Powered by vBulletin®
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
Get Vanilla instead. Trust me.